An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing a signedAttrs encoded in non-canonical form. This bypasses Fort's BER decoder, reaching a point in the code that panics when faced with data not encoded in DER. Because Fort is an RPKI Relying Party, a panic can lead to Route Origin Validation unavailability, which can lead to compromised routing.

Affected: Ubuntu:Pro:20.04:LTS: fort-validator, Ubuntu:22.04:LTS: fort-validator, Ubuntu:Pro:24.04:LTS: fort-validator

Niklas Vogel and Haya Schulmann discovered that FORT Validator did not perform proper input validation when parsing certain RPKI repository data. A remote attacker could possibly use this issue to cause FORT Validator to crash, resulting in a denial of service. (CVE-2024-45234, CVE-2024-45235, CVE-2024-45236, CVE-2024-45238, CVE-2024-45239)

Niklas Vogel and Haya Schulmann discovered that FORT Validator did not perform proper input validation when parsing resource certificates. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-45237)

Koen van Hove discovered that FORT Validator did not limit the duration of data transfers when fetching RPKI repository data. A remote attacker could possibly use this issue to cause FORT Validator to consume excessive resources, resulting in a denial of service. (CVE-2024-48943)