<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.5pt">As you may have heard, six vulnerabilities have been identified in RSYNC: <a href="https://www.kb.cert.org/vuls/id/952657" target="_blank"><span style="text-decoration:none">https://www.kb.cert.org/vuls/id/952657</span></a>.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.5pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.5pt">ARIN was aware of the six RSYNC CVEs and completed patching of our RPKI RSYNC systems on Jan 15, 2025. Prior to the installation of the patch, our systems were not vulnerable to CVE-2024-12084. Additionally,
we saw no abnormal activity reported by our monitoring tools before the patch was installed.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.5pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.5pt">Our RRDP and RSYNC repositories run independently, so the RRDP repository was not impacted.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#1D1C1D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black;mso-ligatures:none">Regards,<br>
Mark Kosters<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black;mso-ligatures:none">ARIN CTO <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black;mso-ligatures:none"> <o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>