FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2025-01-14 21:31:10 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
11982747-544c-11ee-ac3e-a04a5edf46d9routinator -- multiple vulnerabilities

NLnet Labs report:

This release fixes two issues in Routinator that can be exploited remotely by rogue RPKI CAs and repositories. We therefore advise all users of Routinator to upgrade to this release at their earliest convenience.

The first issue, CVE-2022-39915, can lead to Routinator crashing when trying to decode certain illegal RPKI objects.

The second issue, CVE-2022-39916, only affects users that have the rrdp-keep-responses option enabled which allows storing all received RRDP responses on disk. Because the file name for these responses is derived from the URI and the path wasn't checked properly, a RRDP URI could be constructed that results in the response stored outside the directory, possibly overwriting existing files.


Discovery 2022-12-08
Entry 2023-09-16
routinator
< 0.12.2

CVE-2022-39915
https://nlnetlabs.nl/downloads/routinator/CVE-2023-39915.txt
CVE-2022-39916
https://nlnetlabs.nl/downloads/routinator/CVE-2023-39916.txt