CVE-2024-12133

Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos

State: Published
Severity: 5.3 Medium
Published: Feb 10, 2025
Updated: Oct 22, 2026
Reserved: Dec 4, 2024

Description

A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	redhat

Weaknesses

CWE-407 Inefficient Algorithmic Complexity

Affected Products

Product	Versions
libtasn1	before 4.20.0Affected
Red Hat Enterprise Linux 8Red Hat	0:4.13-5.el8_10 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:4.13-5.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	0:3.6.14-10.el8_4.1 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	0:4.13-3.el8_4.1 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat	0:3.6.14-10.el8_4.1 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat	0:4.13-3.el8_4.1 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	0:3.6.16-5.el8_6.5 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	0:4.13-3.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnRed Hat	0:3.6.16-5.el8_6.5 and laterNot affected
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnRed Hat	0:4.13-3.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat	0:3.6.16-7.el8_8.4 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat	0:4.13-4.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat	0:3.6.16-7.el8_8.4 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat	0:4.13-4.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:4.16.0-9.el9 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:4.16.0-9.el9 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat	0:4.16.0-8.el9_2.1 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat	0:4.16.0-8.el9_4.1 and laterNot affected
Red Hat Discovery 1.14Red Hat	1.14.3-1748529279 and laterNot affected
Red Hat Discovery 1.14Red Hat	1.14.2-1748467619 and laterNot affected
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 6Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat OpenShift Container Platform 4Red Hat

References

RHSA-2025:17347vendor-advisory
RHSA-2025:4049vendor-advisory
RHSA-2025:7077vendor-advisory
RHSA-2025:8021vendor-advisory
RHSA-2025:8385vendor-advisory
RHSA-2026:30849vendor-advisory
RHSA-2026:30850vendor-advisory
RHSA-2026:33125vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-12133vdb-entry
RHBZ#2344611issue-tracking
https://gitlab.com/gnutls/libtasn1/-/blob/master/doc/security/CVE-2024-12133.md
https://gitlab.com/gnutls/libtasn1/-/issues/52
http://www.openwall.com/lists/oss-security/2025/02/06/6
https://lists.debian.org/debian-lts-announce/2025/02/msg00025.html
https://security.netapp.com/advisory/ntap-20250523-0003/
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-202008.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.