CVE-2023-39915

Crashes on parsing certain invalid RPKI objects

State: Published
Severity: 7.5 High
Published: Sep 13, 2023
Updated: Sep 12, 2024
Reserved: Aug 7, 2023

Description

NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NLnet Labs

Weaknesses

CWE-232 Improper Handling of Undefined Values
CWE-240 Improper Handling of Inconsistent Structural Elements

Affected Products

Product	Versions
RoutinatorNLnet Labs	before 0.12.2Affected 0.12.2 and laterNot affected

References

https://nlnetlabs.nl/downloads/routinator/CVE-2023-39915.txtvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.