Path traversal mitigation bypass in OctoRPKI

Impact The existing URI path filters in OctoRPKI version 1.4.3 mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder. Specific Go Packages Affected...

GHSA-3JHM-87M6-X959 Path traversal mitigation bypass in OctoRPKI

Impact The existing URI path filters in OctoRPKI version 1.4.3 mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder. Specific Go Packages Affected...

[SECURITY] [DSA 5041-1] cfrpki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5041-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 11, 2022 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5033-1] fort-validator security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5033-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 30, 2021 https://www.debian.org/security/faq -...

CVE-2021-3907 Arbitrary filepath traversal via URI injection

OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa, which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine...

CVE-2021-3907

CVE-2021-3907 affects OctoRPKI: a URI containing a filename with ".." can cause a repository to write a file outside the base cache folder, potentially enabling remote code execution on the host running OctoRPKI. The connected documents indicate this is a path/traversal issue in the OctoRPKI impl...