Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Jan 29, 2025When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root.CVE-2021-3978 · Other software · Cloudflare · reported by cna@cloudflare.comHigh 7.5
When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root ( https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service ) this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation.
- Product
- octorpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter.CVE-2022-3616 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 5.4
Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.
- Product
- OctoRPKI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2021OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repositCVE-2021-3912 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 4.2
OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).
- Product
- octorpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2021If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.CVE-2021-3911 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 4.2
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
- Product
- octorpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2021OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).CVE-2021-3910 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 4.4
OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).
- Product
- octorpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2021OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever.CVE-2021-3909 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 4.4
OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.
- Product
- octorpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2021OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.CVE-2021-3908 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 5.9
OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.
- Product
- octorpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2021OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex.CVE-2021-3907 · Other software · Cloudflare · reported by cna@cloudflare.comHigh 7.4
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
- Product
- octorpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate.CVE-2021-3761 · Other software · Cloudflare · reported by cna@cloudflare.comHigh 7.5
Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.
- Product
- octorpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.