CVE-2024-56169 Affecting fort-validator package, versions *
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIAN11-FORTVALIDATOR-8528149
- published19 Dec 2024
- disclosed18 Dec 2024
Introduced: 18 Dec 2024
NewCVE-2024-56169 (opens in a new tab)How to fix?
There is no fixed version for Debian:11 fort-validator.
NVD Description
Note: Versions mentioned in the description apply only to the upstream fort-validator package and not the fort-validator package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintain a backup cache of the remote RPKI data. This can be employed as a fallback in case a new fetch fails or yields incorrect files. However, the product currently uses its cache merely as a bandwidth saving tool (because fetching is performed through deltas). If a fetch fails midway or yields incorrect files, there is no viable fallback. This leads to incomplete route origin validation data.