Описание
Security update for libtasn1
This update for libtasn1 fixes the following issues:
Security issue fixed:
- CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).
- CVE-2017-6891: Added safety check to fix a stack overflow issue (bsc#1040621).
- CVE-2021-46848: Fixed off-by-one array size check that affects asn1_encode_simple_der (bsc#1204690)
Список пакетов
SUSE Linux Enterprise Server 12 SP2-BCL
Ссылки
- Link for SUSE-SU-2022:3797-1
- E-Mail link for SUSE-SU-2022:3797-1
- SUSE Security Ratings
- SUSE Bug 1040621
- SUSE Bug 1105435
- SUSE Bug 1204690
- SUSE CVE CVE-2017-6891 page
- SUSE CVE CVE-2018-1000654 page
- SUSE CVE CVE-2021-46848 page
Описание
Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.
Затронутые продукты
Ссылки
- CVE-2017-6891
- SUSE Bug 1040621
- SUSE Bug 1049210
- SUSE Bug 1149679
Описание
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
Затронутые продукты
Ссылки
- CVE-2018-1000654
- SUSE Bug 1105435
Описание
GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
Затронутые продукты
Ссылки
- CVE-2021-46848
- SUSE Bug 1204690
- SUSE Bug 1205081
- SUSE Bug 1205311
- SUSE Bug 1208025