CVE-2021-3909 Infinite open connection causes OctoRPKI to hang forever

2021-11-1121:45:19

CWE-400

cloudflare

www.cve.org

octorpki

cve-2021-3909

infinite connection

slowloris dos

http request

vulnerability

CVSS3

4.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

AI Score

8.7

Confidence

High

EPSS

0.002

Percentile

61.0%

JSON

OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.

CNA Affected

[
  {
    "product": "octorpki",
    "vendor": "Cloudflare",
    "versions": [
      {
        "lessThan": "1.4.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]