CVE-2023-39915
Nlnetlabs Routinator ≤ 0.12.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2023-39915 is a high-severity Improper Handling of Undefined Values (CWE-232) vulnerability in Nlnetlabs Routinator. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-43613
Vulnerability Data
NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and error handling for undefined values.
Integrity protections for data-at-rest commonly include structural consistency checks that prevent or detect the described weakness.
Integrity protections for data-in-transit commonly include structural consistency checks that prevent or detect the described weakness.
Integrity protections for data-in-use commonly include structural consistency checks that prevent or detect the described weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect missing handling of undefined values before release.
Secure development life cycle requires handling of invalid/undefined inputs during design and coding.
Application security requirements include validation of all parameters and handling of unsupported values.
Secure architecture principles mandate explicit handling of undefined or unsupported states.
Secure coding standards directly require defensive checks for undefined or unsupported parameter values.
Change management ensures structural consistency is preserved when modifications are introduced.