Bug 1535578 (CVE-2018-6003)

Summary: CVE-2018-6003 libtasn1: Stack exhaustion due to indefinite recursion during BER decoding
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bcourt, bkearney, erik-fedora, huzaifas, jmatthew, klember, mike, mmccune, mrike, nmavrogi, ohadlevy, rchan, rh-bugzilla, security-response-team, tmraz, tsanders, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:37:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1535924, 1535925, 1535926, 1539171, 1539172    
Bug Blocks: 1535580    

Description Adam Mariš 2018-01-17 16:16:56 UTC 
It was found that indefinite string encoding is decoded via recursion in _asn1_decode_simple_ber() which can lead to stack exhaustion when processing specially crafted string.

Reference:

https://lists.gnu.org/archive/html/help-libtasn1/2018-01/msg00000.html
Comment 1 Adam Mariš 2018-01-17 16:22:22 UTC 
Upstream patch:

https://gitlab.com/gnutls/libtasn1/commit/c593ae84cfcde8fea45787e53950e0ac71e9ca97
Comment 2 Huzaifa S. Sidhpurwala 2018-01-18 09:35:16 UTC 
Created libtasn1 tracking bugs for this issue:

Affects: fedora-all [bug 1535926]


Created mingw-libtasn1 tracking bugs for this issue:

Affects: fedora-all [bug 1535925]
Comment 6 Kurt Seifried 2018-01-26 20:18:51 UTC 
Statement:

This issue affects the versions of libtasn1 as shipped with Red Hat Satellite version 6. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.