Lucene search
GoogleOSV:GHSA-3JHM-87M6-X959HistoryJun 25, 2022 - 7:12 a.m.
Path traversal mitigation bypass in OctoRPKI
2022-06-2507:12:08
Google
osv.dev
16
Impact
The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.
Specific Go Packages Affected
github.com/cloudflare/cfrpki/cmd/octorpki
Patches
The issue was fixed in version 1.4.3
References
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/cloudflare/cfrpki | lt | 1.4.3 |
Related
github
github
Arbitrary filepath traversal via URI injection
2021-11-10 20:08:29
Path traversal mitigation bypass in OctoRPKI
2022-06-25 07:12:08
prion
prion
Remote code execution
2021-11-11 22:15:00
cvelist
cvelist
CVE-2021-3907 Arbitrary filepath traversal via URI injection
2021-11-01 00:00:00
veracode
veracode
Directory Traversal
2021-11-11 08:49:09
osv
osv
Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki
2022-02-14 22:52:15
Arbitrary filepath traversal via URI injection
2021-11-10 20:08:29
nvd
nvd
CVE-2021-3907
2021-11-11 22:15:07
cve
cve
CVE-2021-3907
2021-11-11 22:15:07
ubuntucve
ubuntucve
CVE-2021-3907
2021-11-11 00:00:00
debiancve
debiancve
CVE-2021-3907
2021-11-11 22:15:07
openvas
openvas
Debian: Security Advisory (DSA-5033-1)
2022-01-01 00:00:00
Debian: Security Advisory (DSA-5041-1)
2022-01-12 00:00:00
nessus
nessus
Debian DSA-5033-1 : fort-validator - security update
2021-12-31 00:00:00
Debian DSA-5041-1 : cfrpki - security update
2022-01-12 00:00:00
debian
debian
[SECURITY] [DSA 5033-1] fort-validator security update
2021-12-30 19:35:37
[SECURITY] [DSA 5041-1] cfrpki security update
2022-01-11 21:54:05