Headline
GHSA-3jhm-87m6-x959: Path traversal mitigation bypass in OctoRPKI
Impact
The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.
Patches
The issue was fixed in version 1.4.3
References
Path traversal mitigation bypass in OctoRPKI
High severity GitHub Reviewed Published Jun 25, 2022 in cloudflare/cfrpki