CVE-2022-3616 - Vulnerability Details - OpenCVE

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Cloudflare	Octorpki

Configuration 1 [-]

cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc

History

Mon, 05 May 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: cloudflare

Published: 2022-10-28T06:24:44.189Z

Updated: 2025-05-05T19:19:50.911Z

Reserved: 2022-10-20T11:13:34.797Z

Link: CVE-2022-3616

Vulnrichment

Updated: 2024-08-03T01:14:03.299Z

NVD

Status : Modified

Published: 2022-10-28T07:15:16.557

Modified: 2024-11-21T07:19:53.173

Link: CVE-2022-3616

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-3616", "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "state": "PUBLISHED", "assignerShortName": "cloudflare", "requesterUserId": "25b7b156-39bf-4f6b-8c25-8bc69c5c5e82", "dateReserved": "2022-10-20T11:13:34.797Z", "datePublished": "2022-10-28T06:24:44.189Z", "dateUpdated": "2025-05-05T19:19:50.911Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Go"], "product": "OctoRPKI", "repo": "https://github.com/cloudflare/cfrpki", "vendor": "Cloudflare", "versions": [{"lessThan": "<1.4.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Donika Mirdita - Fraunhofer SIT, ATHENE "}, {"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Haya Shulman - Fraunhofer SIT, ATHENE"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<table><tbody><tr><td>Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.</td></tr></tbody></table><br><br>"}], "value": "Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to\u00a0Donika Mirdita and\u00a0Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.\n\n"}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-834", "description": "CWE-834 Excessive Iteration", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "shortName": "cloudflare", "dateUpdated": "2023-03-29T08:43:36.139Z"}, "references": [{"url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc"}], "source": {"advisory": "GHSA-pmw9-567p-68pc", "discovery": "EXTERNAL"}, "title": "OctoRPKI crash when maximum iterations number is reached", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:14:03.299Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-05T19:18:52.761100Z", "id": "CVE-2022-3616", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-05T19:19:50.911Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:14:03.299Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-3616", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-05T19:18:52.761100Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-05T19:19:28.681Z"}}], "cna": {"title": "OctoRPKI crash when maximum iterations number is reached", "source": {"advisory": "GHSA-pmw9-567p-68pc", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Donika Mirdita - Fraunhofer SIT, ATHENE "}, {"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Haya Shulman - Fraunhofer SIT, ATHENE"}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/cloudflare/cfrpki", "vendor": "Cloudflare", "product": "OctoRPKI", "versions": [{"status": "affected", "version": "0", "lessThan": "<1.4.4", "versionType": "semver"}], "platforms": ["Go"], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to\u00a0Donika Mirdita and\u00a0Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.\n\n", "supportingMedia": [{"type": "text/html", "value": "<table><tbody><tr><td>Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.</td></tr></tbody></table><br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-834", "description": "CWE-834 Excessive Iteration"}]}], "providerMetadata": {"orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "shortName": "cloudflare", "dateUpdated": "2023-03-29T08:43:36.139Z"}}}, "cveMetadata": {"cveId": "CVE-2022-3616", "state": "PUBLISHED", "dateUpdated": "2025-05-05T19:19:50.911Z", "dateReserved": "2022-10-20T11:13:34.797Z", "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "datePublished": "2022-10-28T06:24:44.189Z", "requesterUserId": "25b7b156-39bf-4f6b-8c25-8bc69c5c5e82", "assignerShortName": "cloudflare"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:*", "matchCriteriaId": "4FE6CA13-6865-4A62-B962-38C1C7D8E166", "versionEndExcluding": "1.4.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to\u00a0Donika Mirdita and\u00a0Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.\n\n"}, {"lang": "es", "value": "Los atacantes pueden crear largas cadenas de CA que llevar\u00edan a OctoRPKI a exceder su par\u00e1metro m\u00e1ximo de iterations. En consecuencia provocar\u00eda que el programa colapsara, impidiendo que finalice la validaci\u00f3n y provocando una Denegaci\u00f3n de Servicio. Cr\u00e9ditos a Donika Mirdita y Haya Shulman - Fraunhofer SIT, ATHENE, quienes descubrieron e informaron esta vulnerabilidad."}], "id": "CVE-2022-3616", "lastModified": "2024-11-21T07:19:53.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.2, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-10-28T07:15:16.557", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}, {"lang": "en", "value": "CWE-834"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-834"}], "source": "[email protected]", "type": "Primary"}]}