Skip to content
OpenAdvisories
High DSA-5033-1 4 CVEs

fort-validator - security update

Published Dec 30, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 fort-validator 1.5.3-1~deb11u1

Vulnerabilities 4

  • High 7.5
    CVE-2021-43114

    FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RT…

    fort-validator Debian
  • High 7.4
    CVE-2021-3907

    Arbitrary filepath traversal via URI injection

    OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for re…

    Cloudflare octorpki fort-validator fort-validator Debian Ubuntu Go
  • Medium 4.4
    CVE-2021-3909

    Infinite open connection causes OctoRPKI to hang forever

    OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a respons…

    Cloudflare octorpki fort-validator cfrpki Debian Go
  • Unscored —
    CVE-2021-43173

    Hanging RRDP request

    In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a…

    NLnet Labs Routinator fort-validator fort-validator Debian Ubuntu