CVE-2024-45238

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published
Aug 24, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-452397.5An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync oCVE-2024-45246.1A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. This affects aCVE-2024-452407.4The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deCVE-2024-452417.5A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated atCVE-2024-452427.8EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping oCVE-2024-452445.3Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.CVE-2024-452457.8Diebold Nixdorf – CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-452467.3Diebold Nixdorf – CWE-427: Uncontrolled Search Path ElementCVE-2024-452476.1Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-452487.5Multi-DNC – CWE-35: Path Traversal: '.../...//'CVE-2024-452499.8Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-45256.1A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This vulnerabilit