CVE-2018-6003

NameCVE-2018-6003
DescriptionAn issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4106-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libtasn1-6 (PTS)stretch (security), stretch4.10-1.1+deb9u1fixed
buster4.13-3fixed
bullseye, sid4.16.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libtasn1-3source(unstable)(not affected)
libtasn1-6sourcejessie(not affected)
libtasn1-6sourcestretch4.10-1.1+deb9u1DSA-4106-1
libtasn1-6source(unstable)4.13-2

Notes

[jessie] - libtasn1-6 <not-affected> (Vulnerable code introduced in 4.3)
- libtasn1-3 <not-affected> (Vulnerable code introduced in 4.3)
https://lists.gnu.org/archive/html/help-libtasn1/2018-01/msg00000.html
Affected function introduced in: http://git.savannah.nongnu.org/cgit/libtasn1.git/commit/lib/decoding.c?id=b12bfa8932f44d1d1c25b4a2e385387a62dfbcc9 (libtasn1_4_3)
Fixed by: https://gitlab.com/gnutls/libtasn1/commit/c593ae84cfcde8fea45787e53950e0ac71e9ca97 (libtasn1_4_13)

Search for package or bug name: Reporting problems