Ubuntu alert USN-7813-1 (fort-validator)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7813-1] FORT Validator vulnerabilities
Date:
             
 
Wed, 08 Oct 2025 16:50:35 +0000
Message-ID:
             
 
<E1v6XN5-0005Sm-TC@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7813-1
October 08, 2025

fort-validator vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in FORT Validator.

Software Description:
- fort-validator: RPKI validator and RTR server

Details:

Niklas Vogel and Haya Schulmann discovered that FORT Validator did not
perform proper input validation when parsing certain RPKI repository data.
A remote attacker could possibly use this issue to cause FORT Validator to
crash, resulting in a denial of service. (CVE-2024-45234, CVE-2024-45235,
CVE-2024-45236, CVE-2024-45238, CVE-2024-45239)

Niklas Vogel and Haya Schulmann discovered that FORT Validator did not
perform proper input validation when parsing resource certificates. A
remote attacker could possibly use this issue to cause a denial of service
or execute arbitrary code. (CVE-2024-45237)

Koen van Hove discovered that FORT Validator did not limit the duration of
data transfers when fetching RPKI repository data. A remote attacker could
possibly use this issue to cause FORT Validator to consume excessive
resources, resulting in a denial of service. (CVE-2024-48943)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  fort-validator                  1.6.1-1ubuntu0.1~esm2
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  fort-validator                  1.5.3-1ubuntu0.1

Ubuntu 20.04 LTS
  fort-validator                  1.2.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

After a standard system update you need to restart FORT Validator to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7813-1
  CVE-2024-45234, CVE-2024-45235, CVE-2024-45236, CVE-2024-45237,
  CVE-2024-45238, CVE-2024-45239, CVE-2024-48943

Package Information:
  https://launchpad.net/ubuntu/+source/fort-validator/1.5.3...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmjmlZkACgkQcpJm3tlz
hgFrPg/8DQ8JFTI1HvGhfdH3qdDNQNh47r/nGZ/bv7xKMY0xNxeODTnwDx1Vt8ub
ncEykrZpnVLeqDSBh++brSHU4Wn+Bx5scL1np4PFFW/4yosJSo65UkMEQt0uDHAD
NvDLCEtP1IMEPw0sVoBevRCGWZ39D2jqCcOY8UAlrUPwwfl3SWWnm2bxp1JvuScF
i98FD63+2dXNQyg7lMGLfECJz3J2JoWw89ZJj50XHze7+ChLvTNFxAx/wMecCvTl
AObRGuw0Czq8uvdS5nQSB1BqLOb49sTgHuweB+UaUZXrCw1VEUJvQi1+kekDf0IS
AOuR7W+2IUYMTxrHExUuvzdJpKSYcFlQaO6s7V4OttwXmZJoRKgq+PkB20lF0j9q
rA6qbvKZRoW+hlrJbImFC2ivWDOUHqKN8NhIk2R4NBNzSbkfZEyAwWGq8WPNJJNA
GsUhFSZrcIers+BleuaQMpRXOqO+U/WY/blAQztM1bxfg6o58YDpo92PFwxtRrmY
t32g/FavCVzMy2zcGq+1bPG8ajAFLWlhDPXvNA+BrbsUMJLqp84IjEHCpUJXtn8h
CgbwSFiT/YnaaHrz70c5UFE+fiPBxnZ9KUUufoqRp7py03QzEL6F+xnCXmi5oVgB
FnSLUIFld9RMyqtmM15gFPNBAAosKnwyyNswMN+KElUcFoxy3/c=
=gG3Y
-----END PGP SIGNATURE-----