Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1621972 - (CVE-2018-1000654) CVE-2018-1000654 libtasn1: Infinite loop in _asn1_expand_object_id(ptree) leads to memory exhaustion
CVE-2018-1000654 libtasn1: Infinite loop in _asn1_expand_object_id(ptree) lea...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20180812,reported=2...
: Security
Depends On: 1621973 1621974 1621975 1621976 1621977 1622397
Blocks: 1621979
  Show dependency tree / graph
 
Reported: 2018-08-24 01:17 EDT by Sam Fowler
Modified: 2018-10-30 14:15 EDT (History)
33 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Sam Fowler 2018-08-24 01:17:11 EDT 
The ASN.1 library used in GNUTLS (libtasn1) through versions 4.13 allows for an infinite loop due to an issue in the _asn1_expand_object_id(p_tree) function. An attacker could exploit this via a crafted ASN.1 structure to causing high CPU usage until a resultant out-of-memory error.


Upstream Issue:

https://gitlab.com/gnutls/libtasn1/issues/4
Comment 1 Sam Fowler 2018-08-24 01:18:11 EDT 
Created libtasn1 tracking bugs for this issue:

Affects: fedora-all [bug 1621973]


Created mingw-libtasn1 tracking bugs for this issue:

Affects: epel-7 [bug 1621975]
Affects: fedora-all [bug 1621974]
Comment 3 Doran Moppert 2018-08-27 00:05:59 EDT 
As nmav@ noted in the upstream ticket, this is an issue affecting the "compile-time" parsing of ASN.1 definitions and not runtime code that parses ASN.1 structures with a fixed definition (eg gnutls).  Specifically, asn1_parser2tree() when called with an invalid recursive ASN.1 definition can enter an infinite loop.

Generally, the ASN.1 definition parser is not exposed to untrusted inputs and asn1_parser2tree() offers no worst-case performance guarantees.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.