Executive brief
A vulnerability in the libtasn1 library, which is used to process digital certificates and security structures, can allow an attacker to crash or significantly slow down a system. By sending a specially crafted certificate with a large number of elements, an attacker can force the system to spend excessive time processing the data. This results in a denial-of-service, potentially disrupting secure communications or services that rely on certificate validation.
Technical details
A vulnerability classified as Inefficient Algorithmic Complexity (CWE-407) exists in libtasn1 during the decoding of Distinguished Encoding Rules (DER) data. The root cause is the inefficient handling of specific certificate structures containing a large number of elements, which leads to exponential or high-order polynomial processing time. A remote, unauthenticated attacker can exploit this by providing a specially crafted ASN.1/DER encoded certificate to an application using the library. Successful exploitation results in excessive CPU consumption, leading to a denial-of-service (DoS) condition. Patches have been released by Red Hat, Debian, and the upstream GnuTLS/libtasn1 project.
Affected products
- GNU libtasn1 4.13, 4.16.0
- Red Hat Enterprise Linux 8, 9.2
- Debian Debian LTS
Timeline
- 2025-02-06: disclosed: Initial disclosure on oss-security mailing list
- 2025-02-10: advisory: NVD publication and Red Hat initial CVE assignment
- 2025-04-22: patched: Red Hat Enterprise Linux 8 patch released (RHSA-2025:4049)
- 2025-10-06: patched: Red Hat Enterprise Linux 9.2 patch released (RHSA-2025:17347)
References
- https://access.redhat.com/errata/RHSA-2025:17347
- https://access.redhat.com/errata/RHSA-2025:4049
- https://access.redhat.com/errata/RHSA-2025:7077
- https://access.redhat.com/errata/RHSA-2025:8021
- https://access.redhat.com/errata/RHSA-2025:8385
- https://access.redhat.com/security/cve/CVE-2024-12133
- https://bugzilla.redhat.com/show_bug.cgi?id=2344611