Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2021-3909 →
DEBIAN-CVE-2021-3909
OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically,...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
cfrpki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-1"}]}]
Debian:12
fort-validator
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1"}]}]
Debian:13
fort-validator
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1"}]}]
Debian:14
fort-validator
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1"}]}]
Debian:12
rpki-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5-1"}]}]
Debian:13
rpki-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5-1"}]}]
Debian:14
rpki-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5-1"}]}]
Références
- advisory security-tracker.debian.org