CVE-2023-39915

Published Sep 13, 2023

Last updated 3 months ago

Overview

Description: NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.
Source: sep@nlnetlabs.nl
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

sep@nlnetlabs.nl: CWE-232
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nlnetlabs:routinator:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3121BDD5-0BCF-4B60-9728-58878A8210ED",
            "versionEndExcluding": "0.12.2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References