Routinator 0.11.3 released

We have just released Routinator 0.11.3. This release fixes a vulnerability present in Routinator 0.9.0 up to and including 0.11.2 which causes Routinator to exit if it encounters invalid data in RRDP snapshot or delta files. We have assigned CVE-2022-3029 to this issue.

Due to a mistake in error handling, data in RRDP snapshot and delta files that isn't correctly base 64 encoded is treated as a fatal error and causes Routinator to exit.

Worst case impact of this vulnerability is denial of service for the RPKI data that Routinator provides to routers. This may stop your network from validating route origins based on RPKI data. This vulnerability does not allow an attacker to manipulate RPKI data. We are not aware of exploitation of this vulnerability at this point in time.

Starting with release 0.11.3, Routinator handles encoding errors by rejecting the snapshot or delta file and continuing with validation. In case of an invalid delta file, it will try using the snapshot instead. If a snapshot file is invalid, the update of the repository will fail and an update through rsync is attempted.

We would like to thank Donika Mirdita and Haya Shulman from Fraunhofer SIT and ATHENE for discovering and notifying us about this issue.

All users of Routinator 0.9.0 up to and including 0.11.2 are encouraged to upgrade to Routinator 0.11.3 at their earliest convenience.

The full list of changes is available in the release notes. Instructions on how to upgrade can be found in the manual.