x/vulndb: potential Go vuln in github.com/cloudflare/cfrpki: CVE-2022-3616

[GoVulnBot]

CVE-2022-3616 references github.com/cloudflare/cfrpki, which may be a Go module.

Description:
Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-3616
• JSON: https://github.com/CVEProject/cvelist/tree/4ceeaa561ea27c819e4307c63337134dd237d3b6/2022/3xxx/CVE-2022-3616.json
• web: GHSA-pmw9-567p-68pc
• Imported by: https://pkg.go.dev/github.com/cloudflare/cfrpki?tab=importedby

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/cloudflare/cfrpki
    packages:
      - package: OctoRPKI
description: |
    Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service.
cves:
  - CVE-2022-3616
references:
  - web: https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc

[gopherbot]

Change https://go.dev/cl/446355 mentions this issue: data/excluded: add GO-2022-1089.yaml

[gopherbot]

Change https://go.dev/cl/592835 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607231 mentions this issue: data/reports: unexclude 20 reports (29)