Debian 11: DLA-4066-1 moderate: fort-validator routing compromise

debian lts

February 23, 2025

Multiple vulnerabilities have been discovered in fort-validator, a RPKI validator and RTR server

Topics Covered

security advisory moderate buffer overflow debian Debian updates risk fort-validator RPKI routing compromise rewriting packets route origin validation

Summary

CVE-2024-45234

A malicious RPKI repository that descends from a (trusted) Trust
Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing
a signedAttrs encoded in non-canonical form. This bypasses Fort's
BER decoder, reaching a point in the code that panics when faced
with data not encoded in DER. Because Fort is an RPKI Relying Party,
a panic can lead to Route Origin Validation unavailability, which
can lead to compromised routing.

CVE-2024-45235

A malicious RPKI repository that descends from a (trusted) Trust
Anchor can serve (via rsync or RRDP) a resource certificate
containing an Authority Key Identifier extension that lacks the
keyIdentifier field. Fort references this pointer without sanitizing
it first. Because Fort is an RPKI Relying Party, a crash can lead to
Route Origin Validation unavailability, which can lead to
compromised routing.

CVE-2024-45236

A malicious RPKI repository that descends from a (trusted) Trust