-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 29 Mar 2025 03:13:08 +0100 Source: fort-validator Architecture: source Version: 1.5.4-1+deb12u1 Distribution: bookworm Urgency: medium Maintainer: Marco d'Itri Changed-By: Daniel Leidert Changes: fort-validator (1.5.4-1+deb12u1) bookworm; urgency=medium . * Non-maintainer upload by the Debian LTS Team. * d/control (Build-Depends): Add rsync for running tests. * d/patches/CVE-2024-45234.patch: Add patch to fix CVE-2024-45234. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing a signedAttrs encoded in non-canonical form. This bypasses Fort's BER decoder, reaching a point in the code that panics when faced with data not encoded in DER. Because Fort is an RPKI Relying Party, a panic can lead to Route Origin Validation unavailability, which can lead to compromised routing. * d/patches/CVE-2024-45235.patch: Add patch to fix CVE-2024-45235. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing an Authority Key Identifier extension that lacks the keyIdentifier field. Fort references this pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. * d/patches/CVE-2024-45236.patch: Add patch to fix CVE-2024-45236. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a signed object containing an empty signedAttributes field. Fort accesses the set's elements without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. * d/patches/CVE-2024-45237.patch: Add patch to fix CVE-2024-45237. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a Key Usage extension composed of more than two bytes of data. Fort writes this string into a 2-byte buffer without properly sanitizing its length, leading to a buffer overflow. * d/patches/CVE-2024-45238.patch: Add patch to fix CVE-2024-45238. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. * d/patches/CVE-2024-45239.patch: Add patch to fix CVE-2024-45239. - A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing a null eContent field. Fort dereferences the pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. * d/patches/CVE-2024-48943.patch: Add patch to fix CVE-2024-48943. - A malicious RPKI rsync repository can prevent Fort from finishing its validation run by drip-feeding its content. This can lead to delayed validation and a stale or unavailable Route Origin Validation. (thanks to Jochen Sprickerhof for helping backporting the test case) Checksums-Sha1: 092e78cb5e52da463c1ff3e2a23dce98da2e091f 2052 fort-validator_1.5.4-1+deb12u1.dsc 56ed1009b2168f9720e73b2919c1bf539850f6a2 15024 fort-validator_1.5.4-1+deb12u1.debian.tar.xz 19673fd9c3ddc3158319bda646d0aa71592273d8 7743 fort-validator_1.5.4-1+deb12u1_amd64.buildinfo Checksums-Sha256: f04142155ce149236d792d2ca2ca00ddfe2a5570a6e1f424881f4014dcc245f7 2052 fort-validator_1.5.4-1+deb12u1.dsc 96f2bc609c0d7ab44a9b129a7299e110344cb2e563770bf722c69a369d60bcd9 15024 fort-validator_1.5.4-1+deb12u1.debian.tar.xz de6ad0cd906e0ce101c640a9f648d9d57fbabb41065bd6f50568ae1e3b67da22 7743 fort-validator_1.5.4-1+deb12u1_amd64.buildinfo Files: 2e8deb226b7b33b21b412b2cc92201b4 2052 net optional fort-validator_1.5.4-1+deb12u1.dsc e80e68a675b2804f7239da20cb59198d 15024 net optional fort-validator_1.5.4-1+deb12u1.debian.tar.xz dea60cafd3949f4dfabf54e7e5e87df4 7743 net optional fort-validator_1.5.4-1+deb12u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmhgffUACgkQS80FZ8KW 0F0vcw/8C8pxuvzA8w2FpyXX8hk9w7s/ON/Or/SV0N36/XMEaojcAt/pWRcP2gYj vmSxCwCUQnmS6HLBTtqxIEGVaug6cAGo/jOH2uI8dAxFrKjCTEoQ+xluFtifD9Oi wJGEID5M+n1NDu82Wbkavw7yaAOk0UAGzSFVPZgIrLCb2dHfo6Ns8I0e1bnwjdh1 emUeJz9/RUs5ypvBT9ItP50wP9p1PGKtJLoVxwxFcegrZjByRG+m0bn0TWa8ZeyI Vv0NBbsN4ZLLk/RWhfYpRAGAREl0IDyoSLUP7iCzKUrqkZHZoQZShRdL692cGEoe 2uP4/KheipsGFRWaEHnT5wXcYwiymZmNr3jRXID5JUzdcrVc2OlQEzoqOfTVIm4s GT92cNpo5q8orxvOxdkSnotW/o1kIf04TZ6JwRAtbGTyaiP34cyaflVRgo1jqoSC YTY0cLiHOHHf0IvcbCwDdUQvRGQgrQzx3W8O7ugNtEo/XPpNiVd4adTRC/Nj9wqH LH8HxyX6l87X2dgSfeJaxrBaFzRYfAA3y/mhi5/akiRovKKwnyvRWDofQnZu9rev ymNowNwIZgNiqZ8iLIza79NaFvpcDFTT3iup4gNqobwmtLiaqhOwLHbCCsMuONW0 6w9c4X/w73WSLMotfVMm09ygwrsQh8KDjuMSse6eD6sie0FH0pY= =Vg2h -----END PGP SIGNATURE-----