Skip to content
OpenAdvisories
Unscored CVE-2021-43173 EUVD-2021-30119GHSA-pgwq-8wjv-xhhr

Hanging RRDP request

Published Nov 9, 2021 · Updated Sep 16, 2024 · Assigned by NLnet Labs

Description

In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out value for RRDP connections, this time-out was only applied to individual read or write operations rather than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can continuously extend the time it takes for the request to finish. Since validation will only continue once the update of an RRDP repository has concluded, this delay will cause validation to stall, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.

Affected products

VendorProductAffectedFixed
NLnet Labs Routinator unspecified – ≤ 0.10.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 fort-validator 1.5.3-1 —
Debian 14 rpki-client 7.5-1 —
Debian 13 fort-validator 1.5.3-1 —
Debian 13 rpki-client 7.5-1 —
Debian 12 cfrpki 1.4.0-1 —
Debian 12 fort-validator 1.5.3-1 —
Debian 12 rpki-client 7.5-1 —
Debian 11 cfrpki 1.4.2-1~deb11u1 DSA-5041-1
Debian 11 fort-validator 1.5.3-1~deb11u1 DSA-5033-1
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS fort-validator No fix yet —

Advisories 2

References