Infinite certificate chain depth results in OctoRPKI running forever

ALTO 7.5CVE-2021-3908 · GHSA-g5gj-9ggf-9vmq · GO-2022-0249 · Published 11/11/2021 · updated 17/06/2026

In breve

CVE-2021-3908 è una vulnerabilità ALTO (CVSS 7.5) che riguarda github.com/cloudflare/cfrpki, octorpki (cloudflare).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.73%, superiore al 54.3% delle vulnerabilità.
Correzione: aggiornare a 1.4.0, 1.3.0 o successiva.

Package	Affected versions	Patched versions
github.com/cloudflare/cfrpki Go	`< 1.4.0`	`1.4.0`
octorpki cloudflare	`< 1.3.0`	`1.3.0`

Description

OctoRPKI (github.com/cloudflare/cfrpki/cmd/octorpki) does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.

For more information

If you have any questions or comments about this advisory email us at [email protected]

NVD description

OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.

References

cloudflare/cfrpki security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-3908 · ADVISORY
cloudflare/cfrpki · PACKAGE
cloudflare/cfrpki release v1.4.0 · WEB
debian.org/security/2022/dsa-5041 · WEB

Altre vulnerabilità di github.com/cloudflare/cfrpki

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/cloudflare/cfrpki

< 1.4.0

1.4.0

octorpki

cloudflare

< 1.3.0

1.3.0

Description

For more information

If you have any questions or comments about this advisory email us at [email protected]

NVD description

OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.

Altre vulnerabilità di github.com/cloudflare/cfrpki

Vedi tutto →