1. CVE-Search
  2. CVE-2021-3761
ID CVE-2021-3761
Summary Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.
References
Vulnerable Configurations
  • cpe:2.3:a:cloudflare:octorpki:-:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:-:*:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.2.0:-:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.2.0:-:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.2.0:pre:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.2.0:pre:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:cloudflare:octorpki:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:cloudflare:octorpki:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 04-04-2022 - 13:41)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
Last major update 04-04-2022 - 13:41
Published 09-09-2021 - 14:15
Last modified 04-04-2022 - 13:41
Back to Top