title: Crashes on parsing certain invalid RPKI objects
description: NLnet Labs’ Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.
problem types: CWE-228: Improper Handling of Syntactically Invalid Structure
affected:
{
vendor: NLnet Labs
product: Routinator
versions:
version: *, status: affected, lessThan: 0.12.2, versionType: semver
version: 0.12.2, status: unaffected, lessThan: *, versionType: semver
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
]
solutions: This issue is fixed in 0.12.2 and all later versions.