CVE-2024-45238
High
Description
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.
SeverityHigh
CVSS7.5
Exploit probability—
ProductNicmx Fort Validator
PublishedAug 24, 2024
First seenAug 24, 2024
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- nicmx fort_validator1.6.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nicmx fort_validator | v < 1.6.3 | 1.6.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.