Description
Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even if its unused. There is a noticeable delay during the wipe for a large allocation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcrypto++ | 5.6.4-5 | — |
| Debian 13 | libcrypto++ | 5.6.4-5 | — |
| Debian 12 | libcrypto++ | 5.6.4-5 | — |
| Debian 8 | libcrypto++ | 5.6.1-6+deb8u3 | DSA-3748-1 |
| Debian 7 | libcrypto++ | 5.6.1-6+deb7u3 | DLA-766-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | libcrypto++ | 5.6.1-9ubuntu0.1 | — |
| Ubuntu 14.04 LTS | libcrypto++ | 5.6.1-6+deb8u3build0.14.04.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | libcryptopp | 5.6.5-1.6.1 | SUSE-SU-2021:3301-1 |
| SLES 15 SP2 | libcryptopp | 5.6.5-1.6.1 | SUSE-SU-2021:3301-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | libcryptopp | 5.6.5-1.6.1 | openSUSE-SU-2021:3301-1 |
Advisories 4
- DLA-766-1 libcrypto++ - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3748-1 libcrypto++ - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2021:3301-1 Security update for libcryptopp SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3301-1 Security update for libcryptopp SUSE / openSUSE Security Updates · May 2, 2025
References
- [oss-security] 20161212 Re: CVE Request: Potential DoS in Crypto++ ASN.1 parser mailing-list
- DSA-3748 vendor-advisory
- 94854 vdb-entry
- FEDORA-2019-812b77ed2e vendor-advisory