Moderate Security Vulnerability in GnuTLS: Inefficient DER Decoding Leading to Remote DoS
Summary
ALSA-2025:4051: Moderate: gnutls security update. Affects gnutls versions < 3.6.16-8.el8_10.3. Fixed in 3.6.16-8.el8_10.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GnuTLS is a widely used library that provides the implementation of cryptographic protocols such as SSL, TLS, and DTLS. It is essential for secure communications over networks, enabling applications to encrypt data and authenticate users. The library is integral to many applications and systems that require secure data transmission. However, it has been found to be vulnerable to an issue that can lead to denial of service (DoS) attacks, impacting the availability of services relying on this library.
Vulnerability Detail
The vulnerability identified as CVE-2024-12243 in GnuTLS arises from inefficient DER decoding in the libtasn1 library. This flaw allows an attacker to craft specific inputs that can cause excessive resource consumption, leading to a denial of service. The implications of this vulnerability are significant, as it can be exploited remotely, potentially affecting any application that relies on GnuTLS for secure communications. The attack can result in service outages, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
3.6.16-8.el8_10.3
This is the first release that contains the fix.
sudo dnf update gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of their applications that utilize GnuTLS by implementing network-level controls, such as firewalls or intrusion detection systems, to monitor and restrict suspicious traffic. However, this is not a substitute for applying the security update.
Conclusion
In summary, the GnuTLS library has a moderate security vulnerability that can lead to remote denial of service attacks due to inefficient DER decoding. It is crucial for users to update to the patched version to ensure the security and availability of their applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for gnutls →
FAQ
The vulnerability is related to inefficient DER decoding in the libtasn1 library, which can lead to remote denial of service attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your manifest file like package-lock.json, you can identify if your application is affected.
Failure to address this vulnerability can lead to service outages and denial of service, impacting the availability of applications relying on GnuTLS.
Yes, you should upgrade to version 3.6.16-8.el8_10.3 or later to mitigate the vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
