FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

routinator -- multiple vulnerabilities

Affected packages
routinator < 0.12.2


VuXML ID 11982747-544c-11ee-ac3e-a04a5edf46d9
Discovery 2022-12-08
Entry 2023-09-16

NLnet Labs report:

This release fixes two issues in Routinator that can be exploited remotely by rogue RPKI CAs and repositories. We therefore advise all users of Routinator to upgrade to this release at their earliest convenience.

The first issue, CVE-2022-39915, can lead to Routinator crashing when trying to decode certain illegal RPKI objects.

The second issue, CVE-2022-39916, only affects users that have the rrdp-keep-responses option enabled which allows storing all received RRDP responses on disk. Because the file name for these responses is derived from the URI and the path wasn't checked properly, a RRDP URI could be constructed that results in the response stored outside the directory, possibly overwriting existing files.


CVE Name CVE-2022-39915
CVE Name CVE-2022-39916