published July 30, 2020
⚠️ A sneaky oversight in RIPE NCC RPKI Validator allows fetching of RRDP data even without proper TLS validation — think of it as a delivery driver accepting packages without checking the address. 🤔 Imagine a delivery service that drops off packages at any address they receive, ignoring whether that address is valid or even exists. That’s similar to what’s happening here — data flowing without validation can lead to chaos! This vulnerability can enable remote attackers to bypass access restrictions, potentially allowing unauthorized data or even triggering denial-of-service attacks on critical routing systems. The implications could be severe, causing disruptions that impact internet traffic and accessibility.
Imagine a delivery service that drops off packages at any address they receive, ignoring whether that address is valid or even exists. That’s similar to what’s happening here — data flowing without validation can lead to chaos! In RIPE NCC RPKI Validator 3.x (before version 3.1-2020.07.06.14.28), the RRDP fetch process continues despite a lack of proper TLS HTTPS endpoint validation, making it vulnerable to unauthorized data access and denial of service.
This vulnerability can enable remote attackers to bypass access restrictions, potentially allowing unauthorized data or even triggering denial-of-service attacks on critical routing systems. The implications could be severe, causing disruptions that impact internet traffic and accessibility. To mitigate this issue, upgrade to the latest version of RIPE NCC RPKI Validator (3.1-2020.07.06.14.28 or later) as it addresses this validation oversight. Additionally, review your current configurations to ensure TLS settings are robust and actively validate endpoints before fetching data. You've got this! With these steps, you'll be bolstering your defenses and keeping your systems secure! 🛡️