Security fixes
- Switched to always caching CRL serial numbers to avoid a potential resource exhaustion through re-decoding the list over and over. (#1130)
- Output individual payload items to HTTP clients or disk instead of building the whole set in memory first. (#1131)
- Avoid stack overflow when releasing a payload set by implementing a non-recursive
DropforPayloadInfo. (#1132) - Added a timer to the HTTP/1 connection establishment to prevent indefinite task blocking in the HTTP server. (#1133)
- Added a way to deal with manifest file names clashing with directory names of publication points by ignoring the colliding publication point. (#1134)
- A fetched TA certificate is now only stored if it is found to be valid. This avoids overwriting the last known good certificate. (#1135)
- Added a check to the RRDP collector that the list of deltas is consecutive rather than happily processing non-consecutive lists. (#1139)
- Updated rpki-rs to 0.20.0. This version also includes a number of security fixes. See its release notes for more information.
Improvements
- Move the stored RRDP archive to a temporary place before updating to avoid a partially updated state if processing aborts. (#1136)
- Added a check that the authority key identifier of a CRL matches the subject key identifier of the issuing CA certificate. (#1140)
Bug fixes
- Skip publication points that have never succeeded during dump. Previously, such a publication point would lead to a crash. (#1137)
- Reject CRLs that have a thisUpdate field in the future. (#1138)
Dependencies
- Updated WebPKI roots to latest version.
Acknowledgements
- We would like to thank Qifan Zhang, Palo Alto Networks, as well as Xin Wang and Jiajia Liu, Northwestern Polytechnical University for reporting these issues.