CVE-2022-3616

low-risk
Published 2022-10-28

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Do I need to act?

-
0.07% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / HIGH complexity

Affected Products (1)

Octorpki

Affected Vendors

Cloudflare

References (2)

Third Party Advisory https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc
Third Party Advisory https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc
22
/ 100
low-risk
Severity 17/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal