gsd - gsd-2022-3616

GSD-2022-3616

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Aliases

CVE-2022-3616

Aliases

CVE-2022-3616

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-3616",
    "id": "GSD-2022-3616"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-3616"
      ],
      "details": "Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.",
      "id": "GSD-2022-3616",
      "modified": "2023-12-13T01:19:39.903869Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cna@cloudflare.com",
        "ID": "CVE-2022-3616",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "OctoRPKI",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "\u003c1.4.4"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Cloudflare"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Donika Mirdita - Fraunhofer SIT, ATHENE "
        },
        {
          "lang": "en",
          "value": "Haya Shulman - Fraunhofer SIT, ATHENE"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-754",
                "lang": "eng",
                "value": "CWE-754 Improper Check for Unusual or Exceptional Conditions"
              }
            ]
          },
          {
            "description": [
              {
                "cweId": "CWE-834",
                "lang": "eng",
                "value": "CWE-834 Excessive Iteration"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc",
            "refsource": "MISC",
            "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-pmw9-567p-68pc",
        "discovery": "EXTERNAL"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003cv1.4.4",
          "affected_versions": "All versions before 1.4.4",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-834",
            "CWE-937"
          ],
          "date": "2023-03-29",
          "description": "Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service.",
          "fixed_versions": [
            "v1.4.4"
          ],
          "identifier": "CVE-2022-3616",
          "identifiers": [
            "CVE-2022-3616",
            "GHSA-pmw9-567p-68pc"
          ],
          "not_impacted": "",
          "package_slug": "go/github.com/cloudflare/cfrpki",
          "pubdate": "2022-10-28",
          "solution": "Upgrade to version 1.4.4 or above.",
          "title": "Excessive Iteration",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-3616",
            "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc"
          ],
          "uuid": "ea2090a2-f5da-41ff-92bc-8a68591d6a00",
          "versions": [
            {
              "commit": {
                "sha": "5f64bcd13477b29cd7ddff6fff3c65dfac3423ca",
                "tags": [
                  "v1.4.4"
                ],
                "timestamp": "20221018142244"
              },
              "number": "v1.4.4"
            }
          ]
        },
        {
          "affected_range": "\u003c=v1.4.3",
          "affected_versions": "All versions up to 1.4.3",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-834",
            "CWE-937"
          ],
          "date": "2022-10-31",
          "description": "Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service.",
          "fixed_versions": [
            "v1.4.4"
          ],
          "identifier": "CVE-2022-3616",
          "identifiers": [
            "GHSA-pmw9-567p-68pc",
            "CVE-2022-3616"
          ],
          "not_impacted": "All versions after 1.4.3",
          "package_slug": "go/github.com/cloudflare/cfrpki/cmd/octorpki",
          "pubdate": "2022-10-31",
          "solution": "Upgrade to version 1.4.4 or above.",
          "title": "Excessive Iteration",
          "urls": [
            "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-3616",
            "https://github.com/advisories/GHSA-pmw9-567p-68pc"
          ],
          "uuid": "f9377a42-3455-4681-b71e-2d7c1bd2895d",
          "versions": [
            {
              "commit": {
                "sha": "828f93020875c2a3fdd222b70e4756df0ef4e847",
                "tags": [
                  "v1.4.3"
                ],
                "timestamp": "20220214191058"
              },
              "number": "v1.4.3"
            },
            {
              "commit": {
                "sha": "5f64bcd13477b29cd7ddff6fff3c65dfac3423ca",
                "tags": [
                  "v1.4.4"
                ],
                "timestamp": "20221018142244"
              },
              "number": "v1.4.4"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.4.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@cloudflare.com",
          "ID": "CVE-2022-3616"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-834"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-03-29T09:15Z",
      "publishedDate": "2022-10-28T07:15Z"
    }
  }
}

CVE-2022-3616 (GCVE-0-2022-3616)

Vulnerability from cvelistv5 – Published: 2022-10-28 06:24 – Updated: 2025-05-05 19:19

Title

OctoRPKI crash when maximum iterations number is reached

Summary

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions
CWE-834 - Excessive Iteration

Assigner

cloudflare

References

URL

Tags

https://github.com/cloudflare/cfrpki/security/adv…

Impacted products

	Vendor	Product	Version
	Cloudflare	OctoRPKI	Affected: 0 , < <1.4.4 (semver)

Credits

Donika Mirdita - Fraunhofer SIT, ATHENE Haya Shulman - Fraunhofer SIT, ATHENE

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:14:03.299Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-3616",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-05T19:18:52.761100Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-05T19:19:50.911Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Go"
          ],
          "product": "OctoRPKI",
          "repo": "https://github.com/cloudflare/cfrpki",
          "vendor": "Cloudflare",
          "versions": [
            {
              "lessThan": "\u003c1.4.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Donika Mirdita - Fraunhofer SIT, ATHENE "
        },
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Haya Shulman - Fraunhofer SIT, ATHENE"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eAttackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to\u0026nbsp;Donika Mirdita and\u0026nbsp;Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to\u00a0Donika Mirdita and\u00a0Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-834",
              "description": "CWE-834 Excessive Iteration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-29T08:43:36.139Z",
        "orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
        "shortName": "cloudflare"
      },
      "references": [
        {
          "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc"
        }
      ],
      "source": {
        "advisory": "GHSA-pmw9-567p-68pc",
        "discovery": "EXTERNAL"
      },
      "title": "OctoRPKI crash when maximum iterations number is reached",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
    "assignerShortName": "cloudflare",
    "cveId": "CVE-2022-3616",
    "datePublished": "2022-10-28T06:24:44.189Z",
    "dateReserved": "2022-10-20T11:13:34.797Z",
    "dateUpdated": "2025-05-05T19:19:50.911Z",
    "requesterUserId": "25b7b156-39bf-4f6b-8c25-8bc69c5c5e82",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GSD-2022-3616

CVE-2022-3616 (GCVE-0-2022-3616)

Tags

Sightings

Nomenclature