CVE-2024-45236
High
Description
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a signed object containing an empty signedAttributes field. Fort accesses the set's elements without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.
SeverityHigh
CVSS7.5
Exploit probability—
ProductNicmx Fort-validator
PublishedAug 24, 2024
First seenAug 24, 2024
Weakness typeCWE-20Improper input validation
How to fix
Update
- nicmx fort-validator1.6.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nicmx fort-validator | v < 1.6.3 | 1.6.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.