Description
The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | libtasn1-3 | 2.7-1+squeeze+1 | DSA-2440-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libtasn1 +2 | 2.3-3.el6_2.1 | RHSA-2012:0427 |
| RHEL 6 | rhev-hypervisor6 +1 | 6.2-20120423.1.el6_2 | RHSA-2012:0531 |
| RHEL 5 | gnutls +2 | 1.4.1-7.el5_8.2 | RHSA-2012:0428 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gnutls | 3.4.15-1.1 | openSUSE-SU-2024:10105-1 |
Advisories 5
- RHSA-2012:0531 Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0427 Red Hat Security Advisory: libtasn1 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0428 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2440-1 libtasn1-3 - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10105-1 gnutls-3.4.15-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 57260 third-party-advisory
- RHSA-2012:0427 vendor-advisory
- 48578 third-party-advisory
- RHSA-2012:0531 vendor-advisory
- 49002 third-party-advisory
- FEDORA-2012-4357 vendor-advisory
- [oss-security] 20120320 Re: CVE request: libtasn1 "asn1_get_length_der()" DER decoding issue mailing-list
- [oss-security] 20120321 Re: CVE request: GnuTLS TLS record handling issue / MU-201202-01 mailing-list
- 48488 third-party-advisory
- USN-1436-1 vendor-advisory
- FEDORA-2012-4342 vendor-advisory
- FEDORA-2012-4451 vendor-advisory
- http://www.gnu.org/software/gnutls/security.html
- https://bugzilla.redhat.com/show_bug.cgi?id=804920
- RHSA-2012:0488 vendor-advisory
- FEDORA-2012-4308 vendor-advisory
- SUSE-SU-2014:0320 vendor-advisory
- [gnutls-devel] 20120316 gnutls 3.0.16 mailing-list
- 1026829 vdb-entry
- http://linux.oracle.com/errata/ELSA-2014-0596.html
- 48596 third-party-advisory
- 50739 third-party-advisory
- 48397 third-party-advisory
- 48505 third-party-advisory
- http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/
- [help-libtasn1] 20120319 GNU Libtasn1 2.12 released mailing-list
- [help-libtasn1] 20120319 minimal fix to security issue mailing-list
- [oss-security] 20120320 CVE request: libtasn1 "asn1_get_length_der()" DER decoding issue mailing-list
- DSA-2440 vendor-advisory
- MDVSA-2012:039 vendor-advisory
- FEDORA-2012-4409 vendor-advisory
- 20120320 Mu Dynamics, Inc. Security Advisories MU-201202-01 and MU-201202-02 for GnuTLS and Libtasn1 mailing-list
- FEDORA-2012-4417 vendor-advisory