CVE-2021-43174

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-43174
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43174.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-43174
Aliases
Related
Published
2021-11-09T17:15:07Z
Modified
2024-09-18T03:16:41.931739Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element.

References

Affected packages

Debian:11 / cfrpki

Package

Name
cfrpki
Purl
pkg:deb/debian/cfrpki?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.2-1~deb11u1

Affected versions

1.*

1.2.2-1
1.3.0-1
1.4.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / cfrpki

Package

Name
cfrpki
Purl
pkg:deb/debian/cfrpki?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}