CVE-2021-3907: cloudflare octorpki Improper Input Validation
Vulnerability summary
CVE-2021-3907 is a critical (CVSS 9.8) Improper Input Validation vulnerability in cloudflare octorpki. EPSS estimates a 4.20% chance of exploitation in the next 30 days, higher than 90.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 11-11-2021PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:HDiffers
EPSS trend
Probability
4.20%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.20% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
Debian3 products
- cfrpki< 1.4.0-1
- fort-validator< 1.5.3-1
- debian_linuxEOL10.0 | 11.0
Cloudflare1 product
- octorpki≥ unspecified, < 1.4.3 | < 1.3.0
Github.com/cloudflare1 product
- cfrpki< 1.4.3 | < 1.4.4
Ubuntu1 product
- fort-validatorAll versions (No fix recorded)
4 vendors · 6 products
References
14 links- github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fhX Refsource MISCREPORTWEBThird Party Advisory
- github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959X Refsource MISCWEBThird Party Advisory
Show all 14 references
- github.com/cloudflare/cfrpkiPACKAGE
