Improper Handling of Unexpected Data Type Affecting routinator package, versions >=0.9.0 <0.11.3


0.0
medium

Snyk CVSS

    Attack Complexity Low
    Availability High

    Threat Intelligence

    EPSS 0.09% (36th percentile)
Expand this section
NVD
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUST-ROUTINATOR-3023007
  • published 14 Sep 2022
  • disclosed 14 Sep 2022
  • credit Donika Mirdita, Haya Shulman, ATHENE

How to fix?

Upgrade routinator to version 0.11.3 or higher.

Overview

routinator is a Routinator is a full featured software package that runs as a service which periodically downloads and verifies RPKI data. The built-in HTTP server offers a user interface and API endpoints for various file formats, as well as logging, status and Prometheus metrics.

Affected versions of this package are vulnerable to Improper Handling of Unexpected Data Type due to improper error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error.