CVE-2024-12133

Feb. 21, 2025, 1:15 p.m.

5.3
Medium

Description

A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.

Product(s) Impacted

Product Versions
libtasn1

Weaknesses

CWE-407
Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References

https://access.redhat.com/security/cve/CVE-2024-12133
https://bugzilla.redhat.com/show_bug.cgi?id=2344611
https://gitlab.com/gnutls/libtasn1/-/issues/52
http://www.openwall.com/lists/oss-security/2025/02/06/6
https://lists.debian.org/debian-lts-announce/2025/02/msg00025.html

Tags

secalert@redhat.com
CWE-407
2025-02-10
CVE-2024-12133

CVSS Score

5.3 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: LOW
    • View Vector String

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Date

  • Published: Feb. 10, 2025, 4:15 p.m.
  • Last Modified: Feb. 21, 2025, 1:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.