Routinator vulnerabilities
10 known vulnerabilities in Routinator from NLnet Labs. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Routinator: Improper Handling of Exceptional Conditions
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.
- 7.5 High severity
Routinator: Improper Handling of Exceptional Conditions
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.
- 7.5 High severity
Routinator: Improper Handling of Exceptional Conditions
When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.
- 8.2 High severity
Routinator: Improper Handling of Exceptional Conditions
When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.
- 7.5 High severity
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the…
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.
- 7.5 High severity
Routinator: Improper Limitation of a Pathname to a Restricted Directory
Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to th
- 8.7 High severity
Routinator: Improper Handling of Exceptional Conditions
Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of file descriptors. This condition can be triggered maliciously by an attacker by opening a large number of connections to th
- 7.5 High severity
Routinator: Improper Validation of Syntactic Correctness of Input
The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering illegal characters, resulting in a crash of Routinator.
- 7.5 High severity
Routinator: Improper Handling of Undefined Values
NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.
- 7.5 High severity
Routinator: Improper Handling of Unexpected Data Type
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error and causes Routinator to exit. Worst case impact of this vulne