CVE-2022-3616

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc	Third Party Advisory
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:19

Type	Values Removed	Values Added
References	~~() https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc - Third Party Advisory~~	() https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc - Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~7.5~~	v2 : unknown v3 : 5.4

Information

Published : 2022-10-28 07:15

Updated : 2024-11-21 07:19

NVD link : CVE-2022-3616

Mitre link : CVE-2022-3616

CVE.ORG link : CVE-2022-3616

JSON object : View

Products Affected

cloudflare

octorpki

CWE

CWE-754

Improper Check for Unusual or Exceptional Conditions

CWE-834

Excessive Iteration

{"id": "CVE-2022-3616", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@cloudflare.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-10-28T07:15:16.557", "references": [{"url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc", "tags": ["Third Party Advisory"], "source": "cna@cloudflare.com"}, {"url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@cloudflare.com", "description": [{"lang": "en", "value": "CWE-754"}, {"lang": "en", "value": "CWE-834"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-834"}]}], "descriptions": [{"lang": "en", "value": "Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to\u00a0Donika Mirdita and\u00a0Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.\n\n"}, {"lang": "es", "value": "Los atacantes pueden crear largas cadenas de CA que llevar\u00edan a OctoRPKI a exceder su par\u00e1metro m\u00e1ximo de iterations. En consecuencia provocar\u00eda que el programa colapsara, impidiendo que finalice la validaci\u00f3n y provocando una Denegaci\u00f3n de Servicio. Cr\u00e9ditos a Donika Mirdita y Haya Shulman - Fraunhofer SIT, ATHENE, quienes descubrieron e informaron esta vulnerabilidad."}], "lastModified": "2024-11-21T07:19:53.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FE6CA13-6865-4A62-B962-38C1C7D8E166", "versionEndExcluding": "1.4.4"}], "operator": "OR"}]}], "sourceIdentifier": "cna@cloudflare.com"}

5.4 /10