CVE-2021-3907

OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
Configurations

Configuration 1 (hide)

cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

History

01 Feb 2023, 15:15

Type Values Removed Values Added
References (MISC) https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959 - (MISC) https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959 - Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

23 Jun 2022, 12:15

Type Values Removed Values Added
References
  • (MISC) https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959 -

04 Apr 2022, 13:46

Type Values Removed Values Added
First Time Debian
Debian debian Linux
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
References (DEBIAN) https://www.debian.org/security/2021/dsa-5033 - (DEBIAN) https://www.debian.org/security/2021/dsa-5033 - Third Party Advisory
References (DEBIAN) https://www.debian.org/security/2022/dsa-5041 - (DEBIAN) https://www.debian.org/security/2022/dsa-5041 - Third Party Advisory

12 Jan 2022, 11:15

Type Values Removed Values Added
References
  • (DEBIAN) https://www.debian.org/security/2022/dsa-5041 -

31 Dec 2021, 15:15

Type Values Removed Values Added
References
  • (DEBIAN) https://www.debian.org/security/2021/dsa-5033 -

16 Nov 2021, 15:20

Type Values Removed Values Added
References (MISC) https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fh - (MISC) https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fh - Third Party Advisory
CPE cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : 7.5
v3 : 9.8
CWE CWE-22

11 Nov 2021, 22:15

Type Values Removed Values Added
New CVE

Information

Published : 2021-11-11 22:15

Updated : 2023-12-10 14:09


NVD link : CVE-2021-3907

Mitre link : CVE-2021-3907

CVE.ORG link : CVE-2021-3907


JSON object : View

Products Affected

debian

  • debian_linux

cloudflare

  • octorpki
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-20

Improper Input Validation