Executive brief
ts-asn1-der is a library used to encode and decode ASN.1 data structures in DER format, a standard encoding used in cryptographic certificates and protocols. A bug in the number encoding logic can cause the library to enter an infinite loop (denial of service) when processing certain integer values, and also produce incorrect encoded output, potentially leading to invalid or unrecognized cryptographic data.
Technical details
The vulnerability stems from incorrect arithmetic in the DER encoding of integers, specifically in the numBitLen calculation. When encoding absolute values in the range 2**31 to 2**32-1, a right-shift operation can produce a negative result, causing an infinite loop that denies service. Additionally, the number encoding contains multiple issues that result in incorrect DER-encoded output for certain integer values. The vulnerability affects the Asn1Integer component and can be triggered by local code calling the library with untrusted integer inputs. The issue is fixed in version 1.0.4; users on earlier versions should upgrade or implement input range validation as a workaround.
Affected products
- Apelegh ts-asn1-der < 1.0.4
Timeline
- 2025-04-07: disclosed
- 2025-04-07: patched: Fixed in version 1.0.4