REDHAT-BUG-2344615: Medium severity GNU Libtasn1 vulnerability
The issue is twofold: decoding a DER input with sequences and locating a specific element in a sequence. Even though a DER sequence is conceptually an array, in libtasn1 it is represented as a linked list, whose elements are assigned a string name, such as "?1". Therefore a simple lookup of an element at a given position is linear O(N) time complexity. When decoding a DER sequence, in each step libtasn1 looks up the parent node, recorded on the first element, which requires a backward linear search, resulting in O(N^2) time complexity.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2344615?
The severity of REDHAT-BUG-2344615 has not been specifically classified but it is related to a critical issue with DER input decoding.
How do I fix REDHAT-BUG-2344615?
Fixing REDHAT-BUG-2344615 requires updating the affected software in order to mitigate the decoding issue.
What software is affected by REDHAT-BUG-2344615?
The specific software affected by REDHAT-BUG-2344615 is not listed, but it relates to libtasn1 functionalities.
What are the symptoms of REDHAT-BUG-2344615?
Symptoms of REDHAT-BUG-2344615 include failures in decoding DER sequences and potential lookup errors in linked lists.
Is there a workaround for REDHAT-BUG-2344615?
Currently, there is no documented workaround for REDHAT-BUG-2344615, and users are advised to apply updates when available.