PT-2025-15291 · Unknown · Ts-Asn1-Der

Published 2025-04-07 · Updated 2025-04-08 · CVE-2025-32029

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ts-asn1-der versions prior to 1.0.4

Description The issue is related to incorrect number DER encoding, which can lead to denial of service for absolute values in the range 231 to 232 - 1. This is due to the arithmetic in the numBitLen not taking into account that values in this range could result in a negative result upon applying the >> operator, leading to an infinite loop.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 to resolve the issue. As a temporary workaround, consider validating inputs to Asn1Integer to ensure that they are not smaller than -231 + 1 and no larger than 231 - 1.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

CWE-1335

Related Identifiers

CVE-2025-32029

GHSA-P4QW-7J9G-5H53

Affected Products

Ts-Asn1-Der

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32029.json · Exploit
• https://osv.dev/vulnerability/GHSA-p4qw-7j9g-5h53 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32029 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32029 · Security Note
• https://t.me/cvenotify/118125 · Telegram Post
• https://t.me/cvedetector/22365 · Telegram Post
• https://github.com/ApelegHQ/ts-asn1-der · Note
• https://t.me/cvetracker/21040 · Telegram Post
• https://github.com/ApelegHQ/ts-asn1-der/commit/b2bc9032cbe19755d234a27d79e47a7e52993af8 · Note
• https://github.com/ApelegHQ/ts-asn1-der/security/advisories/GHSA-p4qw-7j9g-5h53 · Note
• https://twitter.com/CVEnew/status/1909343951468834837 · Twitter Post