Go/github.com/cloudflare/cfrpki CVE-2021-3907: high 7.4, EPSS 4.20%

Arbitrary filepath traversal via URI injection

Action: Upgrade github.com/cloudflare/cfrpki to 1.4.4 or later.

go get github.com/cloudflare/cfrpki@v1.4.4

Affected

Fixed versions

Sources

• osv: GHSA-cqh2-vc2f-q4fh
• https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959
• https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fh
• https://nvd.nist.gov/vuln/detail/CVE-2021-3907
• https://github.com/cloudflare/cfrpki/commit/a053a808feeb3115c76b6cc263ee55598ce6e8cd
• https://github.com/cloudflare/cfrpki/commit/eb9cc4db7b7b79e44f56dfaa959fccdfb2af8284
• https://github.com/cloudflare/cfrpki
• https://pkg.go.dev/vuln/GO-2022-0248
• https://www.debian.org/security/2021/dsa-5033
• https://www.debian.org/security/2022/dsa-5041

CVE-2021-3907 · published 2021-11-10T20:08:29Z · modified 2026-02-04T02:22:56.432665Z · JSON