CVE-2021-43172: 
Rust vulnerability analysis and mitigation

CVE-2021-43172 affects NLnet Labs Routinator versions prior to 0.10.2. The vulnerability was discovered and reported by Koen van der Hove and disclosed in November 2021. The issue involves the processing of RRDP (Repository Delta Protocol) repositories, where the software processes chains of infinite length without proper limitations (Vendor Advisory).

The vulnerability occurs in RPKI (Resource Public Key Infrastructure) where a CA can select its RRDP repository for data publication. A malicious CA can exploit this by continuously generating new child CAs that only consist of another CA using a different RRDP repository, creating a chain of CAs of de-facto infinite length. The vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition) and has a CVSS v3.1 base score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (NVD).

When exploited, the vulnerability prevents validation runs from completing, causing Routinator to either continue serving old data sets or, in the case of initial validation runs after startup, never serve any data at all (Vendor Advisory).

The vulnerability has been fixed in Routinator version 0.10.2. Users are advised to upgrade to this version or later to address the security issue (Vendor Advisory).