Improper Handling of Unexpected Data Type Affecting routinator package, versions >=0.9.0 <0.11.3


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.09% (40th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RUST-ROUTINATOR-3023007
  • published14 Sept 2022
  • disclosed14 Sept 2022
  • creditDonika Mirdita, Haya Shulman, ATHENE

Introduced: 14 Sep 2022

CVE-2022-3029  (opens in a new tab)
CWE-241  (opens in a new tab)

How to fix?

Upgrade routinator to version 0.11.3 or higher.

Overview

routinator is a Routinator is a full featured software package that runs as a service which periodically downloads and verifies RPKI data. The built-in HTTP server offers a user interface and API endpoints for various file formats, as well as logging, status and Prometheus metrics.

Affected versions of this package are vulnerable to Improper Handling of Unexpected Data Type due to improper error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error.

CVSS Scores

version 3.1