vulnerability

FreeBSD: VID-11982747-544c-11ee-ac3e-a04a5edf46d9 (CVE-2022-39915): routinator -- multiple vulnerabilities

Severity
2
CVSS
(AV:L/AC:M/Au:N/C:P/I:N/A:N)
Published
Sep 16, 2023
Added
Sep 18, 2023
Modified
Dec 10, 2025

Description

NLnet Labs report: This release fixes two issues in Routinator that can be exploited remotely by rogue RPKI CAs and repositories. We therefore advise all users of Routinator to upgrade to this release at their earliest convenience. The first issue, CVE-2022-39915, can lead to Routinator crashing when trying to decode certain illegal RPKI objects. The second issue, CVE-2022-39916, only affects users that have the rrdp-keep-responses option enabled which allows storing all received RRDP responses on disk. Because the file name for these responses is derived from the URI and the path wasn't checked properly, a RRDP URI could be constructed that results in the response stored outside the directory, possibly overwriting existing files.

Solution

freebsd-upgrade-package-routinator
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.