Description
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a Key Usage extension composed of more than two bytes of data. Fort writes this string into a 2-byte buffer without properly sanitizing its length, leading to a buffer overflow.
References (2)
Core 2
Core References
Patch, Third Party Advisory
https://nicmx.github.io/FORT-validator/CVE.html
Scores
CVSS v3
9.8
EPSS
0.0032
EPSS Percentile
55.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-120
Status
published
Products (1)
nicmx/fort-validator
< 1.6.3
Published
Aug 24, 2024
Tracked Since
Feb 18, 2026