CVE-2020-16163

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-30 · updated 2026-06-17
Weakness: CWE-295

Description

An issue was discovered in RIPE NCC RPKI Validator 3.x before 3.1-2020.07.06.14.28. RRDP fetches proceed even with a lack of validation of a TLS HTTPS endpoint. This allows remote attackers to bypass intended access restrictions, or to trigger denial of service to traffic directed to co-dependent routing systems. NOTE: third parties assert that the behavior is intentionally permitted by RFC 8182

Affected products

Ripe Rpki Validator 3: from 3.0 through 3.1-2020.07.06.14.28

References

https://github.com/RIPE-NCC/rpki-validator-3/issues/159
https://github.com/RIPE-NCC/rpki-validator-3/issues/159

Get alerted when CVE-2020-16163 or the next vulnerability affects your stack