CVE-2024-45238

An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nicmx.github.io/FORT-validator/CVE.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nicmx:fort_validator:*:*:*:*:*:*:*:*

History

22 Apr 2025, 16:24

Type	Values Removed	Values Added
References	~~() https://nicmx.github.io/FORT-validator/CVE.html -~~	() https://nicmx.github.io/FORT-validator/CVE.html - Vendor Advisory
First Time		Nicmx Nicmx fort Validator
CPE		cpe:2.3:a:nicmx:fort_validator::::::::

Information

Published : 2024-08-24 23:15

Updated : 2025-04-22 16:24

NVD link : CVE-2024-45238

Mitre link : CVE-2024-45238

CVE.ORG link : CVE-2024-45238

JSON object : View

Products Affected

nicmx

fort_validator

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2024-45238", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-08-24T23:15:04.303", "references": [{"url": "https://nicmx.github.io/FORT-validator/CVE.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Fort antes de la versi\u00f3n 1.6.3. Un repositorio RPKI malicioso que desciende de un Trust Anchor (confiable) puede servir (a trav\u00e9s de rsync o RRDP) un certificado de recurso que contiene una cadena de bits que no se decodifica correctamente en una clave p\u00fablica del sujeto. OpenSSL no informa este problema durante el an\u00e1lisis, y cuando se compila con versiones de libcrypto de OpenSSL inferiores a 3, Fort imprudentemente elimina la referencia al puntero. Debido a que Fort es una parte de confianza de RPKI, una falla puede provocar que la validaci\u00f3n del origen de la ruta no est\u00e9 disponible, lo que puede comprometer el enrutamiento."}], "lastModified": "2025-04-22T16:24:40.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nicmx:fort_validator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C660C6E-5D9F-44FE-805D-ADC77F2755C2", "versionEndExcluding": "1.6.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}