title: OctoRPKI crash when maximum iterations number is reached
description: Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.
problem types: CWE-754 Improper Check for Unusual or Exceptional Conditions
affected:
{
defaultStatus: unaffected
platforms: Go
product: OctoRPKI
repo: https://github.com/cloudflare/cfrpki
vendor: Cloudflare
versions:
lessThan: <1.4.4, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL