Vulnerability Description
An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X509 Certificate Revocation List files from the RPKI relying party's view. NOTE: some third parties may regard this as a preferred behavior, not a vulnerability
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ripe | Rpki Validator 3 | >= 3.0, <= 3.1-2020.07.06.14.28 |
Related Weaknesses (CWE)
References
- https://github.com/RIPE-NCC/rpki-validator-3/issues/158Issue TrackingThird Party Advisory
- https://github.com/RIPE-NCC/rpki-validator-3/issues/232Issue TrackingThird Party Advisory
- https://github.com/RIPE-NCC/rpki-validator-3/security/advisories/GHSA-q76j-58cx-Third Party Advisory
- https://github.com/RIPE-NCC/rpki-validator-3/issues/158Issue TrackingThird Party Advisory
- https://github.com/RIPE-NCC/rpki-validator-3/issues/232Issue TrackingThird Party Advisory
- https://github.com/RIPE-NCC/rpki-validator-3/security/advisories/GHSA-q76j-58cx-Third Party Advisory
FAQ
What is CVE-2020-16164?
CVE-2020-16164 is a vulnerability with a CVSS score of 7.4 (HIGH). An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent rout...
How severe is CVE-2020-16164?
CVE-2020-16164 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-16164?
Check the references section above for vendor advisories and patch information. Affected products include: Ripe Rpki Validator 3.