https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 07:35:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-183596 EUVD-2026-183596 https://cve.radiocsirt.org/vuln/euvd-2026-183596 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3907 <p>OctoRPKI does not escape a URI with a filename containing &#34;..&#34;, this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.</p> <p>OctoRPKI does not escape a URI with a filename containing &#34;..&#34;, this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-3907 https://cve.radiocsirt.org/vuln/ghsa-3jhm-87m6-x959 <p><strong>Affected:</strong> Go: github.com/cloudflare/cfrpki</p> <p>### Impact The existing URI path filters in OctoRPKI (version &lt; 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.</p> <p>### Specific Go Packages Affected github.com/cloudflare/cfrpki/cmd/octorpki</p> <p>### Patches The issue was fixed in version 1.4.3</p> <p>### References [CVE-2021-3907](https://www.cvedetails.com/cve/CVE-2021-3907/)</p> <p><strong>Affected:</strong> Go: github.com/cloudflare/cfrpki</p> <p>### Impact The existing URI path filters in OctoRPKI (version &lt; 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.</p> <p>### Specific Go Packages Affected github.com/cloudflare/cfrpki/cmd/octorpki</p> <p>### Patches The issue was fixed in version 1.4.3</p> <p>### References [CVE-2021-3907](https://www.cvedetails.com/cve/CVE-2021-3907/)</p> https://cve.radiocsirt.org/vuln/ghsa-3jhm-87m6-x959 https://cve.radiocsirt.org/vuln/gsd-2021-3907 gsd-2021-3907 https://cve.radiocsirt.org/vuln/gsd-2021-3907 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3907 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: fort-validator</p> <p>OctoRPKI does not escape a URI with a filename containing &#34;..&#34;, this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: fort-validator</p> <p>OctoRPKI does not escape a URI with a filename containing &#34;..&#34;, this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3907