PT-2018-2898 · Gnu+4 · Libtasn1+4
Published
2018-08-12
·
Updated
2024-06-15
·
CVE-2018-1000654
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libtasn1 versions 4.12 through 4.13
Description
The issue is related to a denial of service (DoS) in the
asn1 expand object id(p tree) function, which can cause CPU usage to reach 100% when parsing a crafted file with the asn1Parser. This can lead to the program being killed after a long time. The vulnerability is exploitable via parsing a maliciously crafted file and is associated with resource management errors.Recommendations
For libtasn1 versions 4.12 through 4.13, consider disabling the
asn1 expand object id(p tree) function as a temporary workaround until a patch is available. Restrict access to the asn1Parser to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Suse
Ubuntu
Libtasn1