CVE-2024-45238: nicmx fort_validator NULL Pointer Dereference
Vulnerability summary
CVE-2024-45238 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in nicmx fort_validator. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 24-08-2024PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
0.00 pp
From 0.30% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- fort-validator< 1.5.4-1+deb12u1 | < 1.6.3-1
Nicmx1 product
- fort_validator< 1.6.3
Ubuntu1 product
- fort-validator< 1.2.0-1ubuntu0.1~esm1 | < 1.5.3-1ubuntu0.1 | < 1.6.1-1ubuntu0.1~esm2
3 vendors · 3 products
