CVE-2021-43173

In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed
significantly by an RRDP repository by not answering but slowly
drip-feeding bytes to keep the connection alive. This can be used to
effectively stall validation. While Routinator has a configurable time-out
value for RRDP connections, this time-out was only applied to individual
read or write operations rather than the complete request. Thus, if an RRDP
repository sends a little bit of data before that time-out expired, it can
continuously extend the time it takes for the request to finish. Since
validation will only continue once the update of an RRDP repository has
concluded, this delay will cause validation to stall, leading to Routinator
continuing to serve the old data set or, if in the initial validation run
directly after starting, never serve any data at all.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929024&gt;