CVE-2024-45235

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-45235
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-45235.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-45235
Downstream
Published
2024-08-24T23:15:04Z
Modified
2025-10-17T10:59:24.547122Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing an Authority Key Identifier extension that lacks the keyIdentifier field. Fort references this pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.

References

Affected packages

Git / github.com/nicmx/fort-validator

Affected ranges

Type
GIT
Repo
https://github.com/nicmx/fort-validator
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
554c5fa738791173dbf8261d68b4515708fc70ce

Affected versions

1.*

1.5.2
1.5.3
1.5.4
1.6.0
1.6.1
1.6.2

v0.*

v0.0.2

v1.*

v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0
v1.2.1
v1.3.0
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.5.1

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "source": "https://github.com/nicmx/fort-validator/commit/554c5fa738791173dbf8261d68b4515708fc70ce",
        "deprecated": false,
        "id": "CVE-2024-45235-02f74911",
        "target": {
            "file": "src/print_file.c"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "147889449138784577634602238466759049575",
                "269493755503718693970132359291416060958",
                "183467428597507957592080802613304264921",
                "327584951224570290483511414756764349834"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/nicmx/fort-validator/commit/554c5fa738791173dbf8261d68b4515708fc70ce",
        "deprecated": false,
        "id": "CVE-2024-45235-5bd24603",
        "target": {
            "file": "test/tal_test.c"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "50989219936941618529196440800405028605",
                "68482305505019198037374393097522654354",
                "245080040670023987538169387390987987000",
                "24442718220132759855911218662021834770"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/nicmx/fort-validator/commit/554c5fa738791173dbf8261d68b4515708fc70ce",
        "deprecated": false,
        "id": "CVE-2024-45235-6cef58de",
        "target": {
            "file": "test/types/uri_test.c"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "244406567224100079130832236358206550568",
                "192874625895839078802782519432191710424",
                "8368202350100797008376123573611711471",
                "187673777030990722610105519276335209648"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/nicmx/fort-validator/commit/554c5fa738791173dbf8261d68b4515708fc70ce",
        "deprecated": false,
        "id": "CVE-2024-45235-6e166c3c",
        "target": {
            "file": "test/mock.c"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "117657757624396647050250919369354447007",
                "238967847734869426782602542933290486653",
                "231970757348571404241512985359370383534",
                "66094430273658645673717399424594708253"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/nicmx/fort-validator/commit/554c5fa738791173dbf8261d68b4515708fc70ce",
        "deprecated": false,
        "id": "CVE-2024-45235-99bea718",
        "target": {
            "function": "rsync2bio_tmpdir",
            "file": "src/print_file.c"
        },
        "signature_version": "v1",
        "digest": {
            "function_hash": "262246466360906216192910747803551172805",
            "length": 548.0
        }
    }
]