CVE-2021-3909

Uncontrolled Resource Consumption in go/github.com/cloudflare/cfrpki

Identifiers

CVE-2021-3909, GHSA-8cvr-4rrf-f244

Package Slug

go/github.com/cloudflare/cfrpki

Vulnerability

Uncontrolled Resource Consumption

Description

OctoRPKI does not limit the length of a connection, allowing for a slowloris DoS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.

Affected Versions

All versions before 1.3.0

Solution

Upgrade to version 1.3.0 or above.

Last Modified

2021-11-18

source