UBUNTU-CVE-2021-43173

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2021-43173
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-43173.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-43173
Related
Published
2021-11-09T17:15:00Z
Modified
2024-10-15T14:08:28Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out value for RRDP connections, this time-out was only applied to individual read or write operations rather than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can continuously extend the time it takes for the request to finish. Since validation will only continue once the update of an RRDP repository has concluded, this delay will cause validation to stall, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.

References

Affected packages

Ubuntu:20.04:LTS / fort-validator

Package

Name
fort-validator
Purl
pkg:deb/ubuntu/fort-validator?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.1.1-2
1.1.2-1
1.1.3-1
1.2.0-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / cfrpki

Package

Name
cfrpki
Purl
pkg:deb/ubuntu/cfrpki?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.2-1

Affected versions

1.*

1.2.2-1
1.3.0-1
1.4.0-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.4.2-1",
            "binary_name": "octorpki"
        },
        {
            "binary_version": "1.4.2-1",
            "binary_name": "octorpki-dbgsym"
        }
    ]
}

Ubuntu:22.04:LTS / fort-validator

Package

Name
fort-validator
Purl
pkg:deb/ubuntu/fort-validator?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.3-1build1

Affected versions

1.*

1.5.1-1
1.5.2-1
1.5.3-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.5.3-1build1",
            "binary_name": "fort-validator"
        },
        {
            "binary_version": "1.5.3-1build1",
            "binary_name": "fort-validator-dbgsym"
        }
    ]
}

Ubuntu:22.04:LTS / rpki-client

Package

Name
rpki-client
Purl
pkg:deb/ubuntu/rpki-client?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.5-1build1

Affected versions

6.*

6.8p1-2

7.*

7.3-1
7.4-1
7.5-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "7.5-1build1",
            "binary_name": "rpki-client"
        },
        {
            "binary_version": "7.5-1build1",
            "binary_name": "rpki-client-dbgsym"
        }
    ]
}