CVE-2024-12133
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.
Risk Assessment
An attacker can exploit this vulnerability to launch a denial of service (DoS) attack on systems using libtasn1, potentially disrupting critical services such as certificate processing in network applications or authentication systems.
Recommendation
Immediately update libtasn1 to the latest patched version. If an update is not possible, restrict acceptance of certificates from external sources and implement system overload monitoring mechanisms.
Other vulnerabilities in libtasn1
See all- CVE-2015-2806High
A stack-based buffer overflow in asn1_der_decoding in libtasn1 before version 4.4 allows remote attackers to have unspecified impact.
- CVE-2024-12243Medium
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption.
Original NVD description (English source)
A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS