Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki

概要

参考情報

• cloudflare/cfrpki security advisory · WEB
• cloudflare/cfrpki commit a053a80 · WEB
• cloudflare/cfrpki commit eb9cc4d · WEB
• cloudflare/cfrpki · PACKAGE
• cloudflare/cfrpki release v1.4.3 · WEB
• cloudflare/cfrpki security advisory · Third Party Advisory
• cloudflare/cfrpki security advisory · Third Party Advisory
• debian.org/security/2021/dsa-5033 · Third Party Advisory
• debian.org/security/2022/dsa-5041 · Third Party Advisory
• nvd.nist.gov/vuln/detail/CVE-2021-3907 · ADVISORY
• pkg.go.dev/vuln/GO-2022-0248 · WEB

github.com/cloudflare/cfrpki のその他の脆弱性

• CVE-2021-3978中 5.5When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the p…
• GO-2022-0496Path traversal mitigation bypass in OctoRPKI in github.com/cloudflare/cfrpki
• CVE-2022-3616高 7.5Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause th…
• GHSA-3jhm-87m6-x959高Path traversal mitigation bypass in OctoRPKI
• CVE-2021-3912中 6.5OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible…