Lack of data validation In gnutls
Description
The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel5 | 0:1.4.1-7.el5_8.2 | ||
rpm rhel6 | 0:2.3-3.el6_2.1 | ||
rpm rhel6 | - | - |
Aliases
1. 2. 3.