Krill restricted-user role gains full permissions via bulk CA import
Krill users with limited access can change other organizations' settings.
Summary
In Krill 0.16.0 and earlier, users restricted to one CA can use bulk import to make other CAs delegate their prefixes and publish ROAs for them. Operators running affected Krill instances are affected.
Affected when
- Role restricted to a list of CAs
What to do
Update to Krill 0.16.1 or later.
Products and platforms
CVE IDs
Sources
- Advisory: nlnetlabs.nl (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen