| Summary: | <dev-libs/libtasn1-2.12 : DoS (CVE-2012-1569) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | crypto+disabled |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | B3 [glsa] | ||
| Package list: | Runtime testing required: | --- | |
@crypto: can 2.12 go to stable? (In reply to comment #1) > @crypto: > > can 2.12 go to stable? Sure, go ahead. Arches, please test and mark stable: =dev-libs/libtasn1-2.12 Target KEYWORDS : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86" Stable for HPPA. amd64 stable x86 stable alpha/arm/ia64/m68k/s390/sh/sparc stable ppc done CVE-2012-1569 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1569): The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure. ppc64 done Thanks, folks. GLSA Vote: Yes. YES too, request filed. This issue was resolved and addressed in GLSA 201209-12 at http://security.gentoo.org/glsa/glsa-201209-12.xml by GLSA coordinator Sean Amoss (ackle). |
From the package Changelog: libtasn1 version 2.12 was released fixing the following issue: - Corrected DER decoding issue (reported by Matthew Hall). Added self check to detect the problem, see tests/Test_overflow.c. This problem can lead to at least remotely triggered crashes, see further analysis on the libtasn1 mailing list.