CVE-2024-45235: 
Linux Debian vulnerability analysis and mitigation

A vulnerability was discovered in Fort before version 1.6.3, identified as CVE-2024-45235. The issue involves a malicious RPKI repository that descends from a trusted Trust Anchor being able to serve (via rsync or RRDP) a resource certificate containing an Authority Key Identifier extension that lacks the keyIdentifier field. The vulnerability affects Fort, which is an RPKI Relying Party software (FORT Validator, NVD).

The vulnerability occurs when Fort references a pointer without proper sanitization in the Authority Key Identifier extension processing. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability has been classified as a NULL Pointer Dereference (CWE-476) (NVD).

When exploited, this vulnerability can lead to a crash of the Fort validator. Since Fort is an RPKI Relying Party, such a crash can result in Route Origin Validation becoming unavailable, which in turn can lead to compromised routing (FORT Validator, Debian LTS).

The vulnerability has been fixed in Fort version 1.6.3 through commit b1eb3c5. Users are advised to upgrade to this version or later to address the security issue. For Debian 11 bullseye users, the fix has been backported to version 1.5.3-1~deb11u2 (FORT Validator, Debian LTS).