CVE-2023-39914

NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding...

Path traversal

NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructe...

Input validation

NLnet Labs’ Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914...

Input validation

NLnet Labs’ bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding...

CVE-2023-39916 Possible path traversal when storing RRDP responses

NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The...

CVE-2023-39916

NLnet Labs Routinator 0.9.0–0.12.1 and 0.14.0–0.14.2 contain a path traversal vulnerability in the optional keep-rrdp-responses feature. The flaw allows an attacker to craft RRDP request URLs that cause stored responses to be written outside the intended directory due to insufficient URL sanitati...

CVE-2023-39915 Crashes on parsing certain invalid RPKI objects

NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914...

CVE-2023-39915 Crashes on parsing certain invalid RPKI objects

NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914...

CVE-2023-39915

The CVE-2023-39915 entry concerns NLnet Labs’ Routinator up to version 0.12.1, which may crash when parsing certain malformed RPKI objects. Root cause is insufficient input checking in the bcder library (the same underlying issue as CVE-2023-39914). Impact, per the citations, is availability inte...

CVE-2023-39914

The CVE-2023-39914 vulnerability affects NLnet Labs’ bcder library up to version 0.7.2. The root cause is a panic during decoding of certain invalid input data, instead of rejecting it with an error. This can impact both the decoding stage and access to content of types that use delayed decoding....

CVE-2023-39914

NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding...

CVE-2023-39914 BER/CER/DER decoder panics on invalid input

NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding...

CVE-2023-39914 BER/CER/DER decoder panics on invalid input

NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding...

NLnet Labs Routinator Security Breach

NLnet Labs Routinator is an RPKI Resource Public Key Infrastructure validator written in the Rust language by the NLnet Labs team in the Netherlands. A security vulnerability exists in NLnet Labs Routinator version 0.12.1 and earlier, which stems from insufficient input checking and may crash whe...

NLnet Routinator Path Traversal Vulnerability

NLnet Routinator is an RPKI Resource Public Key Infrastructure authenticator from the NLnet team written in the Rust language. A path traversal vulnerability exists in NLnet Routinator version 0.12.1 and earlier, which stems from the presence of a path traversal vulnerability that allows a user t...

routinator -- Possible path traversal when storing RRDP responses

[email protected] reports: NLnet Labs Routinator 0.9.0 up to and including 0.12.1 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these store...

NLnet Labs bcder Security Breach

NLnet Labs bcder is NLnet Labs open source a library . Provides ASN.1 standard Basic Encoding Rules BER and more stringent canonical encoding rules CER and Distinguished Encoding Rules DER variants of decoding and encoding . A security vulnerability exists in NLnet Labs bcder 0.7.2 and earlier...

EulerOS Virtualization 3.0.6.0 : unbound (EulerOS-SA-2023-2215)

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the 'ghost domain names' attack. The...

Huawei EulerOS: Security Advisory for unbound (EulerOS-SA-2023-2215)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2023-078)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-078 advisory. NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by targeting an Unbound instance. Unbound is queri...