{"id":"CVE-2020-16164","aliases":["EUVD-2020-8130","GHSA-h28g-f96v-jhrg","GHSA-q76j-58cx-wp5v"],"status":"disputed","title":"** DISPUTED ** An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14...","description":"An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation \".roa\" files or X509 Certificate Revocation List files from the RPKI relying party's view. NOTE: some third parties may regard this as a preferred behavior, not a vulnerability","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00907,"percentile":0.60346,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-295"],"published":"2020-07-30T15:15:37Z","modified":"2026-10-20T10:51:59Z","fixes":[{"ecosystem":"Maven","package":"net.ripe.rpki:rpki-validator-3","fixed_in":["3.2-2020.10.28.23.06"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.ripe.rpki:rpki-validator-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2-2020.10.28.22.25"},{"fixed":"3.2-2020.10.28.23.06"}]}]},{"source":"osv","ecosystem":"Maven","package":"net.ripe.rpki:rpki-validator-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-2020.10.28.23.06"}]}]}],"products":[{"vendor":"ripe","product":"rpki_validator_3"}],"references":[{"url":"https://github.com/RIPE-NCC/rpki-validator-3/issues/232","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/RIPE-NCC/rpki-validator-3/issues/158","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/RIPE-NCC/rpki-validator-3/security/advisories/GHSA-q76j-58cx-wp5v","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16164"},{"url":"https://github.com/advisories/GHSA-h28g-f96v-jhrg"},{"url":"https://github.com/advisories/GHSA-q76j-58cx-wp5v"}],"sources":{"cve":[{"id":"CVE-2020-16164","description":"An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation \".roa\" files or X509 Certificate Revocation List files from the RPKI relying party's view. NOTE: some third parties may regard this as a preferred behavior, not a vulnerability","status":"disputed","published":"2020-07-30T15:15:37Z","modified":"2024-08-04T13:37:54.17Z","updated_at":"2026-11-02T14:35:59.116379Z"}],"euvd":[{"id":"EUVD-2020-8130","description":"An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation \".roa\" files or X509 Certificate Revocation List files from the RPKI relying party's view. NOTE: some third parties may regard this as a preferred behavior, not a vulnerability","status":"published","published":"2020-07-30T15:15:37Z","modified":"2024-08-04T13:37:54Z","updated_at":"2026-11-03T03:07:28.673063Z"}],"ghsa":[{"id":"GHSA-h28g-f96v-jhrg","title":"** DISPUTED ** An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14...","description":"** DISPUTED ** An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation \".roa\" files or X509 Certificate Revocation List files from the RPKI relying party's view. NOTE: some third parties may regard this as a preferred behavior, not a vulnerability.","status":"published","published":"2022-05-24T17:24:43Z","modified":"2023-01-31T05:08:25Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:49:23.788915Z"},{"id":"GHSA-q76j-58cx-wp5v","title":"Vulnerability in RPKI manifest validation","description":"\nA vulnerability in RPKI manifest validation exists when objects on the manifest are hidden, or expired objects are replayed. An attacker successfully exploiting this vulnerability could prevent new ROAs from being received or selectively hide ROAs, causing routes to become INVALID.\n\nTo exploit this vulnerability, an attacker would need to perform a man in the middle attack on the TLS connection between the validator and an RRDP repository or perform a man in the middle attack against a rsync-only repository.\n\nThe update addresses the vulnerability by implementing validation methods from [RFC 6486bis](https://datatracker.ietf.org/doc/draft-ietf-sidrops-6486bis/00/) and enabling strict validation by default.","status":"published","published":"2020-11-13T17:28:49Z","modified":"2023-01-09T05:04:16Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:09.554044Z"}],"nvd":[{"id":"CVE-2020-16164","description":"An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation \".roa\" files or X509 Certificate Revocation List files from the RPKI relying party's view. NOTE: some third parties may regard this as a preferred behavior, not a vulnerability","status":"disputed","published":"2020-07-30T16:15:11.943Z","modified":"2026-06-17T02:57:48.907Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:10.994748Z"}],"osv":[{"id":"CVE-2020-16164","description":"An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation \".roa\" files or X509 Certificate Revocation List files from the RPKI relying party's view. NOTE: some third parties may regard this as a preferred behavior, not a vulnerability","status":"published","published":"2020-07-30T16:15:11.943Z","modified":"2026-10-20T10:51:59.066769345Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-q76j-58cx-wp5v","title":"Vulnerability in RPKI manifest validation","description":"\nA vulnerability in RPKI manifest validation exists when objects on the manifest are hidden, or expired objects are replayed. An attacker successfully exploiting this vulnerability could prevent new ROAs from being received or selectively hide ROAs, causing routes to become INVALID.\n\nTo exploit this vulnerability, an attacker would need to perform a man in the middle attack on the TLS connection between the validator and an RRDP repository or perform a man in the middle attack against a rsync-only repository.\n\nThe update addresses the vulnerability by implementing validation methods from [RFC 6486bis](https://datatracker.ietf.org/doc/draft-ietf-sidrops-6486bis/00/) and enabling strict validation by default.","status":"published","published":"2020-11-13T17:28:49Z","modified":"2026-07-08T06:50:51.827950617Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}