[USN-7813-1] FORT Validator vulnerabilities

[noreply+usn-bot at canonical.com]

==========================================================================
Ubuntu Security Notice USN-7813-1
October 08, 2025

fort-validator vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in FORT Validator.

Software Description:
- fort-validator: RPKI validator and RTR server

Details:

Niklas Vogel and Haya Schulmann discovered that FORT Validator did not
perform proper input validation when parsing certain RPKI repository data.
A remote attacker could possibly use this issue to cause FORT Validator to
crash, resulting in a denial of service. (CVE-2024-45234, CVE-2024-45235,
CVE-2024-45236, CVE-2024-45238, CVE-2024-45239)

Niklas Vogel and Haya Schulmann discovered that FORT Validator did not
perform proper input validation when parsing resource certificates. A
remote attacker could possibly use this issue to cause a denial of service
or execute arbitrary code. (CVE-2024-45237)

Koen van Hove discovered that FORT Validator did not limit the duration of
data transfers when fetching RPKI repository data. A remote attacker could
possibly use this issue to cause FORT Validator to consume excessive
resources, resulting in a denial of service. (CVE-2024-48943)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  fort-validator                  1.6.1-1ubuntu0.1~esm2
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  fort-validator                  1.5.3-1ubuntu0.1

Ubuntu 20.04 LTS
  fort-validator                  1.2.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

After a standard system update you need to restart FORT Validator to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7813-1
  CVE-2024-45234, CVE-2024-45235, CVE-2024-45236, CVE-2024-45237,
  CVE-2024-45238, CVE-2024-45239, CVE-2024-48943

Package Information:
  https://launchpad.net/ubuntu/+source/fort-validator/1.5.3-1ubuntu0.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20251008/9a9f568b/attachment.sig>