Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:1379-1

Опубликовано: 29 мая 2019
Источник: suse-cvrf

Описание

Security update for libtasn1

This update for libtasn1 fixes the following issues:

Security issues fixed:

  • CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).
  • CVE-2017-6891: Fixed a stack overflow in asn1_find_node() (bsc#1040621).

Список пакетов

Container caasp/v4/nginx-ingress-controller:beta1
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Container suse/ltss/sle12.5/sles12sp5:latest
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Container suse/sles12sp3:latest
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Container suse/sles12sp4:latest
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Container suse/sles12sp5:latest
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-Azure-BYOS
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-Azure-Basic-On-Demand
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-Azure-HPC-BYOS
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-Azure-HPC-On-Demand
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-Azure-SAP-BYOS
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-Azure-SAP-On-Demand
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-Azure-Standard-On-Demand
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-EC2-BYOS
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-EC2-ECS-On-Demand
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-EC2-On-Demand
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-EC2-SAP-BYOS
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-EC2-SAP-On-Demand
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-GCE-BYOS
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-GCE-On-Demand
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-GCE-SAP-BYOS
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-GCE-SAP-On-Demand
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-OCI-BYOS-BYOS
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-OCI-BYOS-SAP-BYOS
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
SUSE Linux Enterprise Desktop 12 SP3
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
libtasn1-6-32bit-4.9-3.10.1
SUSE Linux Enterprise Desktop 12 SP4
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
libtasn1-6-32bit-4.9-3.10.1
SUSE Linux Enterprise Server 12 SP3
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
libtasn1-6-32bit-4.9-3.10.1
SUSE Linux Enterprise Server 12 SP4
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
libtasn1-6-32bit-4.9-3.10.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
libtasn1-6-32bit-4.9-3.10.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4
libtasn1-4.9-3.10.1
libtasn1-6-4.9-3.10.1
libtasn1-6-32bit-4.9-3.10.1
SUSE Linux Enterprise Software Development Kit 12 SP3
libtasn1-devel-4.9-3.10.1
SUSE Linux Enterprise Software Development Kit 12 SP4
libtasn1-devel-4.9-3.10.1

Ссылки

Описание

Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.

Затронутые продукты
Container caasp/v4/nginx-ingress-controller:beta1:libtasn1-4.9-3.10.1
Container caasp/v4/nginx-ingress-controller:beta1:libtasn1-6-4.9-3.10.1
Container suse/ltss/sle12.5/sles12sp5:latest:libtasn1-4.9-3.10.1
Container suse/ltss/sle12.5/sles12sp5:latest:libtasn1-6-4.9-3.10.1
Ссылки

Описание

GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.

Затронутые продукты
Container caasp/v4/nginx-ingress-controller:beta1:libtasn1-4.9-3.10.1
Container caasp/v4/nginx-ingress-controller:beta1:libtasn1-6-4.9-3.10.1
Container suse/ltss/sle12.5/sles12sp5:latest:libtasn1-4.9-3.10.1
Container suse/ltss/sle12.5/sles12sp5:latest:libtasn1-6-4.9-3.10.1
Ссылки
Уязвимость SUSE-SU-2019:1379-1