Denial of Service Vulnerability in libtasn1: CPU Exhaustion Risk
Summary
ALPINE-CVE-2018-1000654: GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after... Affects libtasn1 versions < 4.14-r0. Fixed in 4.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtasn1 is a library for handling ASN.1 (Abstract Syntax Notation One) data structures, commonly used in various applications for encoding and decoding data. It provides essential functionality for parsing ASN.1 encoded data, which is crucial for many networking protocols and data interchange formats. However, vulnerabilities in libtasn1 can lead to severe consequences, including denial of service attacks that can cripple applications relying on this library.
Vulnerability Detail
The vulnerability identified as CVE-2018-1000654 affects libtasn1 versions prior to 4.14-r0. It is a Denial of Service (DoS) vulnerability that arises from an issue in the function _asn1_expand_object_id(p_tree). When a crafted ASN.1 file is parsed using the asn1Parser, the CPU usage spikes to 100%, leading to potential application crashes after prolonged processing. This vulnerability can be exploited by attackers who can craft malicious ASN.1 files, causing significant resource exhaustion and service disruption.
How To Fix
Minimum fixed version
4.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade libtasn1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to reject malformed ASN.1 files before they are processed by libtasn1. This can help mitigate the risk of triggering the vulnerability.
Conclusion
The CVE-2018-1000654 vulnerability in libtasn1 poses a significant risk of Denial of Service due to excessive CPU usage when processing crafted ASN.1 files. It is crucial for users of libtasn1 to update to the patched version to mitigate this risk. Additionally, employing input validation can serve as a temporary measure until the update can be applied.
See every vulnerability recorded for libtasn1 →
FAQ
CVE-2018-1000654 is a Denial of Service vulnerability in the libtasn1 library that can lead to high CPU usage and application crashes when processing crafted ASN.1 files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to service disruptions, as the affected application may become unresponsive due to excessive CPU usage.
Yes, the patch is available in libtasn1 version 4.14-r0 and later. Updating to this version will resolve the vulnerability.
If you cannot update immediately, implement input validation to reject malformed ASN.1 files as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libtasn1.
