Impact

The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.

Specific Go Packages Affected

github.com/cloudflare/cfrpki/cmd/octorpki

Patches

The issue was fixed in version 1.4.3

References

CVE-2021-3907

References

• GHSA-3jhm-87m6-x959
• GHSA-cqh2-vc2f-q4fh
• https://nvd.nist.gov/vuln/detail/CVE-2021-3907
• https://github.com/cloudflare/cfrpki/releases/tag/v1.4.3