| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/cloudflare/cfrpki | < 1.4.3< 1.4.4 | 1.4.31.4.4 |
| octorpki | < 1.3.0 | 1.3.0 |
In the case that a malicious TAL file is parsed pointing to a repository that provides a malicious ROA file which octorpki downloads, it is possible to bypass the current directory traversal mitigation to allow writing outside of the current directory.
No patch release has been made
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free