Is CVE-2024-12243 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-12243 being exploited in the wild.

How severe is CVE-2024-12243?

Medium severity, with a CVSS score of 5.3, published 10 February 2025.

Which products and versions are affected?

GnuTLS GnuTLS 3.6.x, 3.7.x; GnuTLS libtasn1; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2.

Is there a fix for CVE-2024-12243?

A patch was published on 2025-04-22: Red Hat released updates for RHEL 8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-12243 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-12243?

Check whether you run Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9.2. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-12243: GnuTLS denial of service via inefficient DER decoding in libtasn1

CVE-2024-12243 · Severity: medium · CVSS 5.3 · Published 2025-02-10

A performance flaw was identified in GnuTLS, a widely used security library that enables encrypted communications for many applications and operating systems. By sending a specially crafted digital certificate, a remote attacker can force the system to spend an excessive amount of time processing the data. This can cause the affected service to become slow or completely unresponsive, leading to a denial-of-service for legitimate users.

Technologies: Red Hat Enterprise Linux 8. Vendors: Red Hat.

Quick answers

Is CVE-2024-12243 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-12243 being exploited in the wild.
How severe is CVE-2024-12243?: Medium severity, with a CVSS score of 5.3, published 10 February 2025.
Which products and versions are affected?: GnuTLS GnuTLS 3.6.x, 3.7.x; GnuTLS libtasn1; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2.
Is there a fix for CVE-2024-12243?: A patch was published on 2025-04-22: Red Hat released updates for RHEL 8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-12243 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-12243?: Check whether you run Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9.2. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in GnuTLS due to inefficient algorithmic complexity (CWE-407) within the libtasn1 library used for ASN.1 data processing. The root cause is an inefficient algorithm used during the decoding of DER-encoded certificate data. A remote, unauthenticated attacker can exploit this by providing a specially crafted certificate that triggers excessive CPU and memory consumption during the decoding process. This results in a denial-of-service (DoS) condition where the GnuTLS-linked application becomes unresponsive. Patches have been released by various vendors, including Red Hat and Debian, to address the issue in libtasn1 and GnuTLS.

Affected products

GnuTLS GnuTLS 3.6.x, 3.7.x
GnuTLS libtasn1
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9.2

Timeline

2024-12-12: disclosed: Date based on CVE ID assignment year and subsequent reporting
2025-02-10: advisory: Initial NVD publication date
2025-04-22: patched: Red Hat released updates for RHEL 8
2025-10-06: patched: Red Hat released updates for RHEL 9.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.