CVE-2022-3616CWE-754CWE-834

OctoRPKI crash when maximum iterations number is reached

Medium · published October 28, 2022

CVSS v3.1
5.4
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00449 · 38.0th percentile
Weaknesses
CWE-754 · Improper Check for Unusual or Exceptional Conditions; CWE-834 · Excessive Iteration
Published
2022-10-28T06:24Z
EPSS history
Timeline
  • 28 OCT 06:24Z
    OctoRPKI crash when maximum iterations number is reached
    cvelistv5