Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 949497 (CVE-2024-12133) - <dev-libs/libtasn1-4.20.0: Denial of service
Summary: <dev-libs/libtasn1-4.20.0: Denial of service
Status: IN_PROGRESS
Alias: CVE-2024-12133
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa? cleanup]
Keywords:
Depends on: 951246
Blocks:
  Show dependency tree
 
Reported: 2025-02-09 04:27 UTC by Sam James
Modified: 2025-04-14 08:23 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2025-02-09 04:27:01 UTC
From 4.20.0 NEWS:
```
+* Noteworthy changes in release 4.20.0 (2025-02-01) [stable]
+- The release tarball is now reproducible.
+- We publish a minimal source-only tarball generated by 'git archive'.
+- Update gnulib files and various build/maintenance fixes.
+- Fix CVE-2024-12133: Potential DoS in handling of numerous SEQUENCE OF or SET OF elements
+
```
Comment 1 Larry the Git Cow gentoo-dev 2025-02-09 04:32:35 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4ba6d3c31e981be734c49c185fa856766b1c0436

commit 4ba6d3c31e981be734c49c185fa856766b1c0436
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2025-02-09 04:29:18 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2025-02-09 04:29:18 +0000

    dev-libs/libtasn1: add 4.20.0
    
    Bug: https://bugs.gentoo.org/949497
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-libs/libtasn1/Manifest               |  2 ++
 dev-libs/libtasn1/libtasn1-4.20.0.ebuild | 54 ++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)