CVE-2021-3912CWE-400

OctoRPKI crashes when processing GZIP bomb returned via malicious repository

Medium · published November 11, 2021

CVSS v3.1
4.2
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00850 · 57.7th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2021-11-11T21:45Z
EPSS history
Timeline
  • 11 NOV 21:45Z
    OctoRPKI crashes when processing GZIP bomb returned via malicious repository
    cvelistv5