rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-43074 
An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.
Problem types: cwe_id: CWE-347
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiSwitch
default_status: unaffected
vendor: Fortinet
product: FortiWeb
default_status: unaffected
vendor: Fortinet
product: FortiProxy
default_status: unaffected
vendor: Fortinet
product: FortiOS
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C
Published: 2023-02-16T18:05:27.932Z
CVE-2021-43075 
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the alarm dashboard and controller config handlers.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiWLM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.3
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
version: 3.1
Published: 2022-03-01T18:25:11.000Z
CVE-2021-43076 
An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and below may allow a remote authenticated attacker with restricted user profile to modify the system files using the shell access.
Problem types: description: Improper access control
Affected products: vendor: Fortinet
product: FortiADC
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: FUNCTIONAL
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 6.2
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X
version: 3.1
Published: 2022-09-06T15:15:17.000Z
CVE-2021-43077 
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP monitor handlers.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiWLM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.3
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
version: 3.1
Published: 2022-03-01T18:30:11.000Z
CVE-2021-43080 
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version 6.4.0 through 6.4.9, version 7.0.0 through 7.0.5 may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack through the URI parameter via the Threat Feed IP address section of the Security Fabric External connectors.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiOS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: FUNCTIONAL
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 4.5
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:F/RL:X/RC:X
version: 3.1
Published: 2022-09-06T15:15:23.000Z
CVE-2021-43081 
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below, 6.0.14 to 6.0.0. and in FortiProxy version 7.0.1 and below, 2.0.7 to 2.0.0 web filter override form may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.
Problem types: description: Unauthorized code execution
Affected products: vendor: Fortinet
product: Fortinet FortiProxy
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: WORKAROUND
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 6
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:X/RL:W/RC:X
version: 3.1
Published: 2022-05-11T14:30:18.000Z
CVE-2021-43082 heap-buffer-overflow with stats-over-http plugin
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Credits: lang: en
value: Apache Traffic Server would like to thank Masori Koshiba for finding this issue.
Published: 2021-11-03T15:20:27.000Z
CVE-2021-43083 Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response
Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
cwe_id: CWE-191
description: CWE-191 Integer Underflow (Wrap or Wraparound)
Affected products: vendor: Apache Software Foundation
product: Apache PLC4X
Credits: lang: en
value: Apache PLC4X would like to thank Eugene Lim for reporting this issue.
Published: 2021-12-19T08:25:09.000Z
CVE-2021-43084 
An SQL Injection vulnerability exists in Dreamer CMS 4.0.0 via the tableName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-24T17:13:01.000Z
CVE-2021-43086 
ARM astcenc 3.2.0 is vulnerable to Buffer Overflow. When the compression function of the astc-encoder project with -cl option was used, a stack-buffer-overflow occurred in function encode_ise() in function compress_symbolic_block_for_partition_2planes() in "/Source/astcenc_compress_symbolic.cpp".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T14:06:31.000Z
CVE-2021-43090 
An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T15:47:12.000Z
CVE-2021-43091 
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T16:14:57.000Z
CVE-2021-43094 
An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters in patient.page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-10T11:40:48.000Z
CVE-2021-43097 
A Server-side Template Injection (SSTI) vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T21:02:42.000Z
CVE-2021-43098 
A File Upload vulnerability exists in bbs v5.3 via QuestionManageAction.java in a getType function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T21:06:23.000Z
CVE-2021-43099 
An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T21:16:14.000Z
CVE-2021-43100 
A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T21:19:55.000Z
CVE-2021-43101 
A File Upload vulnerability exists in bbs 5.3 is via MembershipCardManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T21:22:23.000Z
CVE-2021-43102 
A File Upload vulnerability exists in bbs 5.3 is via HelpManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T21:25:37.000Z
CVE-2021-43103 
A File Upload vulnerability exists in bbs 5.3 is via ForumManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T21:28:44.000Z
CVE-2021-43105 
A vulnerability in the bailiwick checking function in Technitium DNS Server <= v7.0 exists that allows specific malicious users to inject `NS` records of any domain (even TLDs) into the cache and conduct a DNS cache poisoning attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T22:02:34.000Z
CVE-2021-43106 
A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the request to be sent to a completely different Domain/IP address. This is due to that the server implicitly trusts the Host header, and fails to validate or escape it properly. An attacker can use this input to redirect target users to a malicious domain/web page. This would result in expanding the potential to further attacks and malicious actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T19:48:07.000Z
CVE-2021-43109 
An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in product.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-29T17:33:44.000Z
CVE-2021-43110 
An Access Conrol vulnerability exists in PuneethReddyHC online-shopping-system as of 11/01/2021 in add_products.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-29T17:40:03.000Z
CVE-2021-43113 
iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T00:00:00.000Z
CVE-2021-43114 
FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T00:00:00.000Z
CVE-2021-43116 
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-05T00:00:00.000Z
CVE-2021-43117 
fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-13T11:31:35.000Z
CVE-2021-43118 
A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-29T19:37:57.000Z
CVE-2021-43129 
A bypass exists for Desire2Learn/D2L Brightspace’s “Disable Right Click” option in the quizzing feature, which allows a quiz-taker to access print and copy functionality via the browser’s right click menu even when “Disable Right Click” is enabled on the quiz.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-19T12:08:30.000Z
CVE-2021-43130 
An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the username parameter in customer/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T14:52:38.000Z
CVE-2021-43136 
An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-10T11:09:18.000Z
CVE-2021-43137 
Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chaining to this both vulnerabilities leads to account takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-01T19:14:50.000Z
CVE-2021-43138 
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-06T00:00:00.000Z
CVE-2021-43140 
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T18:38:33.000Z
CVE-2021-43141 
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter in plan_application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T18:40:38.000Z
CVE-2021-43142 
An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T21:05:37.000Z
CVE-2021-43145 
With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T14:23:30.000Z
CVE-2021-43154 
Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-13T22:20:22.000Z
CVE-2021-43155 
Projectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the "bookisbn" parameter in cart.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T17:24:57.000Z
CVE-2021-43156 
In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete any book.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T17:22:27.000Z
CVE-2021-43157 
Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T17:28:20.000Z
CVE-2021-43158 
In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T17:27:07.000Z
CVE-2021-43159 
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the setSessionTime function in /cgi-bin/luci/api/common..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T00:08:59.000Z
CVE-2021-43160 
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the switchFastDhcp function in /cgi-bin/luci/api/diagnose.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T00:08:46.000Z
CVE-2021-43161 
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the doSwitchApi function in /cgi-bin/luci/api/switch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T00:08:37.000Z
CVE-2021-43162 
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiagnose function in /cgi-bin/luci/api/diagnose.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T00:08:50.000Z
CVE-2021-43163 
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet function in /cgi-bin/luci/api/auth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T00:08:24.000Z
CVE-2021-43164 
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T00:08:17.000Z
CVE-2021-43171 
Improper verification of applications' cryptographic signatures in the /e/OS app store client App Lounge before 0.19q allows attackers in control of the application server to install malicious applications on user's systems by altering the server's API response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2021-43172 Infinite length chain of RRDP repositories
NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a new child CA that only consists of another CA using a different RRDP repository, a malicious CA can create a chain of CAs of de-facto infinite length. Routinator prior to version 0.10.2 did not contain a limit on the length of such a chain and will therefore continue to process this chain forever. As a result, the validation run will never finish, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.
Problem types: cwe_id: CWE-674
description: CWE-674: Uncontrolled Recursion
Affected products: vendor: NLnet Labs
product: Routinator
Credits: lang: en
value: We would like to thank Koen van Hove for the discovery.
Published: 2021-11-09T16:41:39.328Z
CVE-2021-43173 Hanging RRDP request
In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out value for RRDP connections, this time-out was only applied to individual read or write operations rather than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can continuously extend the time it takes for the request to finish. Since validation will only continue once the update of an RRDP repository has concluded, this delay will cause validation to stall, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.
Problem types: cwe_id: CWE-755
description: CWE-755: Improper Handling of Exceptional Conditions
Affected products: vendor: NLnet Labs
product: Routinator
Credits: lang: en
value: We would like to thank Koen van Hove for the discovery.
Published: 2021-11-09T16:41:40.253Z
CVE-2021-43174 gzip transfer encoding caused out-of-memory crash
NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element.
Problem types: cwe_id: CWE-1325
description: CWE-1325: Improperly Controlled Sequential Memory Allocation
Affected products: vendor: NLnet Labs
product: Routinator
Credits: lang: en
value: We would like to thank Koen van Hove for the discovery.
Published: 2021-11-09T16:41:41.211Z