We take security very seriously. If you have found a security issue in one of our RPKI products, please submit a security report.

Missing files should result in entire CA being considered invalid

Credit:Job Snijders
Affects:Routinator up to and including version 0.7.1
Not affected:Other versions
Impact:A legitimate route is marked as RPKI invalid
Solution:Install Routinator 0.8.0 or newer

An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X.509 Certificate Revocation List files from the RPKI relying party's view.

Routinator 0.8.0 follows the rules proposed by draft-ietf-sidrops-6486bis. It ensures that if any object published by a CA is found to be invalid, the entire CA – including all its objects – is rejected. This means that none of its ROAs are included nor are any of its child CAs even being looked at. This avoids a possible situation where a legitimate route is being marked as RPKI invalid because only a subset of the ROAs covering its prefix were considered valid and used.