NLnet Labs NLnetLabs Routinator

Possible path traversal when storing RRDP responses

Routinator crashes on specifically crafted RRDP XML files

Routinator cache path traversal using rogue rsync URIs

Routinator crashes on specifically crafted ASN strings in the API

Hanging RRDP request

Infinite length chain of RRDP repositories

gzip transfer encoding caused out-of-memory crash

Routinator terminates when RTR connection is reset too quickly after opening

Invalid RPKI data could disable Route Origin Validation on RTR clients.

Fatal error on incorrect base64 data in RRDP

Crashes on parsing certain invalid RPKI objects

An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X509 Certificate Revocation List files from the RPKI relying party's view.