CVE-2021-3909

Uncontrolled Resource Consumption in go/github.com/cloudflare/cfrpki/cmd/octorpki

Identifiers

GHSA-8cvr-4rrf-f244, CVE-2021-3909

Package Slug

go/github.com/cloudflare/cfrpki/cmd/octorpki

Vulnerability

Uncontrolled Resource Consumption

Description

OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.

Affected Versions

All versions before 1.4

Solution

Upgrade to version 1.4 or above.

Last Modified

2022-01-11

source