REDHAT-BUG-804920: High severity GNU Libtasn1 vulnerability
libtasn1 version 2.12 was released fixing the following issue:
- Corrected DER decoding issue (reported by Matthew Hall). Added self check to detect the problem, see tests/Testoverflow.c. This problem can lead to at least remotely triggered crashes, see further analysis on the libtasn1 mailing list.
http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/53
Upstream and few limited details are available at:
http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/54
The behavior of asn1getlengthder was changed to protect against accidental incorrect use, if though it was previously "working properly and as documented".
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-804920?
The severity of REDHAT-BUG-804920 is high due to potential remotely triggered crashes.
How do I fix REDHAT-BUG-804920?
To fix REDHAT-BUG-804920, update to libtasn1 version 2.12 or later.
What causes the issue in REDHAT-BUG-804920?
The issue in REDHAT-BUG-804920 is caused by a DER decoding flaw.
Who reported the problem in REDHAT-BUG-804920?
The problem in REDHAT-BUG-804920 was reported by Matthew Hall.
What type of software is affected by REDHAT-BUG-804920?
The affected software for REDHAT-BUG-804920 is GNU libtasn1.