CVE-2024-45235
High
Description
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing an Authority Key Identifier extension that lacks the keyIdentifier field. Fort references this pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.
SeverityHigh
CVSS7.5
Exploit probability—
ProductNicmx Fort Validator
PublishedAug 24, 2024
First seenAug 24, 2024
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- nicmx fort_validator1.6.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nicmx fort_validator | v < 1.6.3 | 1.6.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.