Is CVE-2024-12133 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-12133 being exploited in the wild.

How severe is CVE-2024-12133?

Medium severity, with a CVSS score of 5.3, published 10 February 2025.

Is there a fix for CVE-2024-12133?

A patch was published on 2025-04-22: Red Hat Enterprise Linux 8 patch released (RHSA-2025:4049) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-12133 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-12133?

Check whether you run Debian or Gnu Libtasn1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-12133: GNU libtasn1 denial of service via inefficient DER decoding

CVE-2024-12133 · Severity: medium · CVSS 5.3 · Published 2025-02-10

A vulnerability in the libtasn1 library, which is used to process digital certificates and security structures, can allow an attacker to crash or significantly slow down a system. By sending a specially crafted certificate with a large number of elements, an attacker can force the system to spend excessive time processing the data. This results in a denial-of-service, potentially disrupting secure communications or services that rely on certificate validation.

Technologies: Debian. Vendors: Debian, Gnu.

Quick answers

Is CVE-2024-12133 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-12133 being exploited in the wild.
How severe is CVE-2024-12133?: Medium severity, with a CVSS score of 5.3, published 10 February 2025.
Which products and versions are affected?: Gnu Libtasn1 4.13, 4.16.0.
Is there a fix for CVE-2024-12133?: A patch was published on 2025-04-22: Red Hat Enterprise Linux 8 patch released (RHSA-2025:4049) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-12133 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-12133?: Check whether you run Debian or Gnu Libtasn1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as Inefficient Algorithmic Complexity (CWE-407) exists in libtasn1 during the decoding of Distinguished Encoding Rules (DER) data. The root cause is the inefficient handling of specific certificate structures containing a large number of elements, which leads to exponential or high-order polynomial processing time. A remote, unauthenticated attacker can exploit this by providing a specially crafted ASN.1/DER encoded certificate to an application using the library. Successful exploitation results in excessive CPU consumption, leading to a denial-of-service (DoS) condition. Patches have been released by Red Hat, Debian, and the upstream GnuTLS/libtasn1 project.

Affected products

GNU libtasn1 4.13, 4.16.0
Red Hat Enterprise Linux 8, 9.2
Debian Debian LTS

Timeline

2025-02-06: disclosed: Initial disclosure on oss-security mailing list
2025-02-10: advisory: NVD publication and Red Hat initial CVE assignment
2025-04-22: patched: Red Hat Enterprise Linux 8 patch released (RHSA-2025:4049)
2025-10-06: patched: Red Hat Enterprise Linux 9.2 patch released (RHSA-2025:17347)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.