Executive brief
A performance flaw was identified in GnuTLS, a widely used security library that enables encrypted communications for many applications and operating systems. By sending a specially crafted digital certificate, a remote attacker can force the system to spend an excessive amount of time processing the data. This can cause the affected service to become slow or completely unresponsive, leading to a denial-of-service for legitimate users.
Technical details
A vulnerability exists in GnuTLS due to inefficient algorithmic complexity (CWE-407) within the libtasn1 library used for ASN.1 data processing. The root cause is an inefficient algorithm used during the decoding of DER-encoded certificate data. A remote, unauthenticated attacker can exploit this by providing a specially crafted certificate that triggers excessive CPU and memory consumption during the decoding process. This results in a denial-of-service (DoS) condition where the GnuTLS-linked application becomes unresponsive. Patches have been released by various vendors, including Red Hat and Debian, to address the issue in libtasn1 and GnuTLS.
Affected products
- GnuTLS GnuTLS 3.6.x, 3.7.x
- GnuTLS libtasn1
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9.2
Timeline
- 2024-12-12: disclosed: Date based on CVE ID assignment year and subsequent reporting
- 2025-02-10: advisory: Initial NVD publication date
- 2025-04-22: patched: Red Hat released updates for RHEL 8
- 2025-10-06: patched: Red Hat released updates for RHEL 9.2
References
- https://access.redhat.com/errata/RHSA-2025:17361
- https://access.redhat.com/errata/RHSA-2025:4051
- https://access.redhat.com/errata/RHSA-2025:7076
- https://access.redhat.com/errata/RHSA-2025:8020
- https://access.redhat.com/errata/RHSA-2025:8385
- https://access.redhat.com/security/cve/CVE-2024-12243
- https://bugzilla.redhat.com/show_bug.cgi?id=2344615