CVE-2020-16163

CRITICAL

RIPE NCC RPKI Validator 3.x < 3.1-2020.07.06.14.28 - Improper Certificate Validation

Title source: llm
STIX 2.1

Description

An issue was discovered in RIPE NCC RPKI Validator 3.x before 3.1-2020.07.06.14.28. RRDP fetches proceed even with a lack of validation of a TLS HTTPS endpoint. This allows remote attackers to bypass intended access restrictions, or to trigger denial of service to traffic directed to co-dependent routing systems. NOTE: third parties assert that the behavior is intentionally permitted by RFC 8182

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
https://github.com/RIPE-NCC/rpki-validator-3/issues/159

Scores

CVSS v3 9.1
EPSS 0.0127
EPSS Percentile 66.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Details

CWE
CWE-295
Status published
Products (1)
ripe/rpki_validator_3 3.0 - 3.1-2020.07.06.14.28
Published Jul 30, 2020
Tracked Since Feb 18, 2026