-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 29 Mar 2025 03:13:08 +0100 Source: fort-validator Binary: fort-validator fort-validator-dbgsym Architecture: amd64 Version: 1.5.4-1+deb12u1 Distribution: bookworm Urgency: medium Maintainer: amd64 / i386 Build Daemon (x86-ubc-01) Changed-By: Daniel Leidert Description: fort-validator - RPKI validator and RTR server Changes: fort-validator (1.5.4-1+deb12u1) bookworm; urgency=medium . * Non-maintainer upload by the Debian LTS Team. * d/control (Build-Depends): Add rsync for running tests. * d/patches/CVE-2024-45234.patch: Add patch to fix CVE-2024-45234. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing a signedAttrs encoded in non-canonical form. This bypasses Fort's BER decoder, reaching a point in the code that panics when faced with data not encoded in DER. Because Fort is an RPKI Relying Party, a panic can lead to Route Origin Validation unavailability, which can lead to compromised routing. * d/patches/CVE-2024-45235.patch: Add patch to fix CVE-2024-45235. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing an Authority Key Identifier extension that lacks the keyIdentifier field. Fort references this pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. * d/patches/CVE-2024-45236.patch: Add patch to fix CVE-2024-45236. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a signed object containing an empty signedAttributes field. Fort accesses the set's elements without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. * d/patches/CVE-2024-45237.patch: Add patch to fix CVE-2024-45237. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a Key Usage extension composed of more than two bytes of data. Fort writes this string into a 2-byte buffer without properly sanitizing its length, leading to a buffer overflow. * d/patches/CVE-2024-45238.patch: Add patch to fix CVE-2024-45238. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. * d/patches/CVE-2024-45239.patch: Add patch to fix CVE-2024-45239. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing a null eContent field. Fort dereferences the pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. * d/patches/CVE-2024-48943.patch: Add patch to fix CVE-2024-48943. - A malicious RPKI rsync repository can prevent Fort from finishing its validation run by drip-feeding its content. This can lead to delayed validation and a stale or unavailable Route Origin Validation. (thanks to Jochen Sprickerhof for helping backporting the test case) Checksums-Sha1: 9f1b221d3f4c343eb376f72dd420cba7fee5d4d1 629148 fort-validator-dbgsym_1.5.4-1+deb12u1_amd64.deb 56477f1c5ac8eb9c88191d47a73551a9b21d84dc 7269 fort-validator_1.5.4-1+deb12u1_amd64-buildd.buildinfo 422fd33088c8e0dc1f17ebe91f100de6435f3161 206484 fort-validator_1.5.4-1+deb12u1_amd64.deb Checksums-Sha256: 40047f99e1ce5f7abeafbe7be1af6f104fbec274c87c19bf9ded3fdfbfe69095 629148 fort-validator-dbgsym_1.5.4-1+deb12u1_amd64.deb c76f67ba28b0513d2727a25e66509c465e69d40f06d2f42ca36e8373beb9b9c0 7269 fort-validator_1.5.4-1+deb12u1_amd64-buildd.buildinfo 50c9de218fa5140489e8d93fe424837a081d26ae115871be401b910f71e56fa2 206484 fort-validator_1.5.4-1+deb12u1_amd64.deb Files: e355bb65251ed5076550edd0efd2a95d 629148 debug optional fort-validator-dbgsym_1.5.4-1+deb12u1_amd64.deb 8487f4d35876522010f2f1b0106dc717 7269 net optional fort-validator_1.5.4-1+deb12u1_amd64-buildd.buildinfo bb9fc93e2111eb17e2abdc489299def9 206484 net optional fort-validator_1.5.4-1+deb12u1_amd64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEnw0rdzqckKx6dwRTEbCLukZn24oFAmhpU2kACgkQEbCLukZn 24rWPA/+P6VHtOpD9Od7QjrWr3TByWyNC9nu8WghA2mpbXTkkCL/Eyu9QrMTDGrj Nmd43GDWr350y2+rc7IgLhv0iMJ/A0kuLyUWrBx8ihPURTlgV1BE0Tx3qXSx43o4 3yPK5ucmDpphqzYQmQitpKBtgq77K+23bG0znL3AZ99YEG6a4lngKzlHy6I5VxDS pnuFibg44RcC+LVL7S2ObepqZXkjHKwN4YjTjOstpYe13X6s3lpbEZc6fRK4mxL+ xcHnx/URMXNPoJM5QzJOQrKQgMp4KviQ1lXC9tdcAhZCtY/+vjAKhl237ecL3dXS noiEj6ECeiurojOxo9Ts2YE6HOMxjz5mbBt8qDk0bnSAW+b3X9hNmNV/SnYerZPC 9hYgC/IZCp4bDIUxWlpBi2neju3n6oFBFduwn54O4S4cl6pBXTfybwjh2doFk/Xd 9oKa3HInYMWmiwnkagUhtbNJET3MtBrKi0XexX9l4jVIaakzfZVmb6UFh7okgEm+ vPvvH0LXOwG1DL+eX/as0IvBA53ab1oJezzAVJExecOylIXHhav3ReZ4Q/EdwG3g 366uQV+Hvtgv12StzctZtJa8qtrEbqTF7KjYl6JTibJR+MWWtAukT7XEke8O44ME J4NcalAqXvYi9wv4vIqRCoVH0Pk7pbNvZPVDrkFiUX1i6+21fD0= =Rsyr -----END PGP SIGNATURE-----