Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-12133: When an input DER data contains a large number of SEQUENCE OF or SET OF elements, decoding the data and searching a specific element in it take quadratic time to complete. This could be utilized for a remote DoS attack by presenting a crafted certificate to the network peer.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libtasn1 | 0:4.19.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | libtasn1-debuginfo | 0:4.19.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | libtasn1-debugsource | 0:4.19.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | libtasn1-devel | 0:4.19.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | libtasn1-tools | 0:4.19.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | libtasn1-tools-debuginfo | 0:4.19.0-1.amzn2023.0.5 |
Vulnerabilities 1
-
Medium 5.3
Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos
A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to s…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-12133.html