CVE-2024-12243

Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos

State: Published
Severity: 5.3 Medium
Published: Feb 10, 2025
Updated: Oct 22, 2026
Reserved: Dec 5, 2024

Description

A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	redhat

Weaknesses

CWE-407 Inefficient Algorithmic Complexity

Affected Products

Product	Versions
gnutls	3.6.16 and earlierAffected 3.7.0 through 3.7.11Affected 3.8.0 to before 3.8.8Affected 3.8.9 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:3.6.16-8.el8_10.3 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:3.6.16-8.el8_10.3 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:3.8.3-6.el9 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:3.8.3-6.el9 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat	0:3.7.6-21.el9_2.4 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat	0:3.8.3-4.el9_4.2 and laterNot affected
Red Hat Discovery 1.14Red Hat	1.14.3-1748529279 and laterNot affected
Red Hat Discovery 1.14Red Hat	1.14.2-1748467619 and laterNot affected
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 6Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat OpenShift Container Platform 4Red Hat

References

RHSA-2025:17361vendor-advisory
RHSA-2025:4051vendor-advisory
RHSA-2025:7076vendor-advisory
RHSA-2025:8020vendor-advisory
RHSA-2025:8385vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-12243vdb-entry
RHBZ#2344615issue-tracking
https://gitlab.com/gnutls/gnutls/-/issues/1553
https://gitlab.com/gnutls/libtasn1/-/issues/52
https://lists.debian.org/debian-lts-announce/2025/02/msg00027.html
https://security.netapp.com/advisory/ntap-20250523-0002/
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-202008.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.