Niklas Vogel

**Name of the Vulnerable Software and Affected Versions** Routinator (affected versions not specified) **Description** The issue arises from the initial code parsing the manifest not checking the content of file names, while later code assumes this check has been performed. When encountering illegal characters, the system panics, resulting in a crash of Routinator. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Fort versions 1.6.3 through 1.6.4 **Description** An integer underflow was discovered in Fort, allowing a malicious RPKI repository that descends from a trusted Trust Anchor to serve a Manifest RPKI object containing an empty fileList. This causes Fort to dereference and write to the array during a shuffle attempt, before the validation that would normally reject it when empty, resulting in an out-of-bounds access due to the integer underflow. The surrounding loop iterates infinitely, causing the product to become permanently stuck and nearly guaranteeing a crash. **Recommendations** For Fort versions 1.6.3 and 1.6.4, update to version 1.6.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the RPKI repository to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Fort versions prior to 1.6.3 **Description** An issue was discovered in Fort where a malicious RPKI repository that descends from a trusted Trust Anchor can serve a signed object containing an empty `signedAttributes` field via rsync or RRDP. Fort accesses the set's elements without sanitizing it first, which can lead to a crash and Route Origin Validation unavailability, resulting in compromised routing. **Recommendations** For versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the RPKI repository to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Fort versions prior to 1.6.3 **Description** An issue was discovered in Fort where a malicious RPKI repository that descends from a trusted Trust Anchor can serve a resource certificate containing an Authority Key Identifier extension that lacks the `keyIdentifier` field. Fort references this pointer without sanitizing it first, which can lead to a crash and make Route Origin Validation unavailable, resulting in compromised routing. **Recommendations** For versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the RPKI repository to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Fort versions prior to 1.6.3 **Description** An issue was discovered in Fort where a malicious RPKI repository that descends from a trusted Trust Anchor can serve a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. **Recommendations** For versions prior to 1.6.3, upgrade to version 1.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the RPKI repository to minimize the risk of exploitation. Avoid using the `rsync` or `RRDP` protocols with untrusted repositories until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Fort versions prior to 1.6.3 **Description** An issue was discovered in Fort where a malicious RPKI repository that descends from a trusted Trust Anchor can serve an ROA or a Manifest containing a null eContent field via rsync or RRDP. Fort dereferences the pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. **Recommendations** For versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the RPKI repository to minimize the risk of exploitation. Avoid using the `eContent` field in the affected ROA or Manifest until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Fort versions prior to 1.6.3 Description: The issue is related to a buffer overflow in the stack due to improper sanitization of the length of a Key Usage extension in a resource certificate served by a malicious RPKI repository. This can allow a remote attacker to execute arbitrary code. A malicious RPKI repository that descends from a trusted Trust Anchor can serve a resource certificate containing a Key Usage extension composed of more than two bytes of data, which Fort writes into a 2-byte buffer without properly sanitizing its length, leading to a buffer overflow. Recommendations: For versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the RPKI repository or disabling the use of resource certificates with Key Usage extensions until a patch is available. Avoid using the `Key Usage` extension in resource certificates served by RPKI repositories until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Fort versions prior to 1.6.3 **Description** An issue was discovered in Fort where a malicious RPKI repository that descends from a trusted Trust Anchor can serve an ROA or a Manifest containing a signedAttrs encoded in non-canonical form. This bypasses Fort's BER decoder, reaching a point in the code that panics when faced with data not encoded in DER. Because Fort is an RPKI Relying Party, a panic can lead to Route Origin Validation unavailability, which can lead to compromised routing. **Recommendations** For versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the RPKI repository to minimize the risk of exploitation. Avoid using non-canonical encoded signedAttrs in ROAs or Manifests until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Routinator versions 0.9.0 through 0.12.1 **Description** The issue concerns a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature of Routinator. This feature allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructed from the URL of the request. Due to insufficient sanitation of the URL, it is possible for an attacker to craft a URL that results in the response being stored outside of the directory specified for it. **Recommendations** For Routinator versions 0.9.0 through 0.12.1, consider disabling the keep-rrdp-responses feature until a patch is available to prevent potential path traversal attacks. Restrict access to the directory where responses are stored to minimize the risk of exploitation. Avoid using the keep-rrdp-responses feature with untrusted RRDP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Routinator versions up to and including 0.12.1 **Description** The issue is caused by insufficient input checking in the bcder library, which may lead to a crash when trying to parse certain malformed RPKI objects. **Recommendations** For versions up to and including 0.12.1, update to a version that includes the fix for the insufficient input checking in the bcder library to prevent crashes when parsing malformed RPKI objects. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs' bcder library versions 0.7.2 and earlier **Description** The bcder library panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding. **Recommendations** For versions 0.7.2 and earlier, update to version 0.7.3 or later, which fixes the issue by more thoroughly checking inputs and returning errors as expected. As a temporary workaround, consider implementing additional input validation to prevent the library from panicking when encountering invalid data.

**Name of the Vulnerable Software and Affected Versions** BIND versions prior to the fixed version **Description** The issue is related to the DNSSEC implementation in the DNS protocol, which can be exploited by remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses. This is known as the "KeyTrap" issue. The protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records, which can lead to CPU exhaustion when there is a zone with many DNSKEY and RRSIG records. The estimated number of potentially affected devices worldwide is not specified. However, it is mentioned that this issue can potentially cause extended Internet outages by sending a single malicious packet that sends DNS servers into an unresolvable loop. **Recommendations** To resolve the issue, users should upgrade to a version of BIND that contains the fix for this vulnerability. As a temporary workaround, consider using a non-validating resolver to remove the vulnerability, although this is not recommended. Restrict access to the vulnerable DNSSEC validation module to minimize the risk of exploitation. Avoid using the `ValidatingResolver` for DNSSEC validation until the issue is resolved.