UBUNTU-CVE-2021-43174

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2021-43174
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-43174.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-43174
Related
Published
2021-11-09T17:15:00Z
Modified
2021-11-09T17:15:00Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element.

References

Affected packages

Ubuntu:22.04:LTS / cfrpki

Package

Name
cfrpki
Purl
pkg:deb/ubuntu/cfrpki?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.2-1

Affected versions

1.*

1.2.2-1
1.3.0-1
1.4.0-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.4.2-1",
            "binary_name": "octorpki"
        },
        {
            "binary_version": "1.4.2-1",
            "binary_name": "octorpki-dbgsym"
        }
    ]
}