CVE-2021-43114 (Markdown, published 2021-11-09T13:15Z)
Description: value: FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/NICMx/FORT-validator
Files changed:
docs/_config.yml
docs/intro-fort.md
docs/usage.md
man/fort.8
src/object/certificate.c
Commit message: Protocolary updates for release 1.5.2


Vulnerable code:
fort-latest-version: 1.5.1
| [8209](https://tools.ietf.org/html/rfc8209) (BGPSec Certificates)          | 100%        |
> Note: The paragraphs below apply to [Fort 1.5.0](https://github.com/NICMx/FORT-validator/releases/tag/v1.5.0).

File where the ROAs (found during each validation run) will be stored (in CSV format).

If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output, use a hyphen (`-`). If the RTR server is [enabled](#--mode), then the ROAs will be printed every [`--server.interval.validation`](#--serverintervalvalidation) seconds.

Each line of the result is printed in the following order: _AS, Prefix, Max prefix length_. The first line contains the column names.

If `--output.roa` is omitted, the ROAs are not printed.

> Note: The paragraphs below apply to [Fort master](https://github.com/NICMx/FORT-validator).

> Note: The paragraphs below apply to [Fort 1.5.0](https://github.com/NICMx/FORT-validator/releases/tag/v1.5.0).

File where the BGPsec Router Keys (found during each validation run) will be stored (in CSV format).

Since most of the data (Subject Key Identifier and Subject Public Key Info) is binary, it is base64url-encoded, without trailing pads.

If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output console, use a hyphen (`-`). If the RTR server is [enabled](#--mode), the BGPsec Router Keys will be printed every [`--server.interval.validation`](#--serverintervalvalidation) seconds.

Each line of the result is printed in the following order: _AS, Subject Key Identifier, Subject Public Key Info_. The first line contains the column names.

If `--output.bgpsec` is ommited, then the BGPsec Router Keys are not printed.

> Note: The paragraphs below apply to [Fort master](https://github.com/NICMx/FORT-validator).
> Note: This flag only exists in [Fort master](https://github.com/NICMx/FORT-validator).

.TH fort 8 "2021-08-05" "v1.5.1" "FORT validator"

Fixed code:
fort-latest-version: 1.5.2
| [8209](https://tools.ietf.org/html/rfc8209) (BGPSec Certificates)          | 0% (This code was [disabled](https://github.com/NICMx/FORT-validator/issues/58#issuecomment-941977925) in version 1.5.2) |
> ![Warning!](img/warn.svg) BGPsec certificate validation has been disabled in version 1.5.2 because of [this bug](https://github.com/NICMx/FORT-validator/issues/58). It will be restored in version 1.5.3.
.TH fort 8 "2021-10-19" "v1.5.2" "FORT validator"
.B \-\-server.deltas.lifetime=\fIUNSIGNED_INTEGER\fR
.RS 4
When routers first connect to Fort, they request a snapshot of the validation results. (ROAs and Router Keys.) Because they need to keep their validated objects updated, and snapshots tend to be relatively large amounts of information, they request deltas afterwards over configurable intervals. ("Deltas" being the differences between snapshots.)
.P
During each validation cycle, Fort generates a new snapshot, as well as the deltas needed to build the new snapshot from the previous one. These are all stored in RAM. \fI--server.deltas.lifetime\fR is the number of iterations a set of deltas will be kept before being deallocated. (Recall that every iteration lasts \fI--server.interval.validation\fR seconds, plus however long the validation takes.)
.P
If a router lags behind, to the point Fort has already deleted the deltas it needs to update the router’s snapshot, Fort will have to fall back to fetch the entire latest snapshot instead.
.RE
.P

	*result = EE; /* Shuts up nonsense gcc 8.3 warning */