Lucene search

K
freebsdFreeBSD7844789A-9B1F-11ED-9A3F-B42E991FC52E
HistoryJan 10, 2023 - 12:00 a.m.

net/krill -- DoS vulnerability

2023-01-1000:00:00
vuxml.freebsd.org
22
net/krill
dos
vulnerability
rrdp
endpoint
unix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

38.8%

MITRE reports:

	NLnet Labs Krill supports direct access to the RRDP repository
	content through its built-in web server at the "/rrdp" endpoint.
	Prior to 0.12.1 a direct query for any existing directory under
	"/rrdp/", rather than an RRDP file such as "/rrdp/notification.xml"
	as would be expected, causes Krill to crash. If the built-in "/rrdp"
	endpoint is exposed directly to the internet, then malicious remote
	parties can cause the publication server to crash. The repository
	content is not affected by this, but the availability of the server
	and repository can cause issues if this attack is persistent and is
	not mitigated. .
OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchkrill< 0.12.1UNKNOWN

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

38.8%

Related for 7844789A-9B1F-11ED-9A3F-B42E991FC52E