Security Update for libtasn1-3
Summary
DLA-1038-1: libtasn1-3 - security update. Affects libtasn1-3 versions < 2.13-2+deb7u5. Fixed in 2.13-2+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libtasn1-3 is a library that provides Abstract Syntax Notation One (ASN.1) parsing and encoding functionality. It is commonly used in various applications to handle ASN.1 data structures. However, a vulnerability has been discovered in versions prior to 2.13-2+deb7u5, which could allow an attacker to cause a denial of service (DoS) by triggering a NULL pointer dereference and crash.
Vulnerability Detail
The vulnerability, identified as CVE-2017-10790, originates from a flaw in the _asn1_check_identifier function of GNU Libtasn1. When processing specially crafted input, this function can assign a NULL value within an asn1_node structure, leading to a NULL pointer dereference and subsequent crash. Exploiting this vulnerability could result in a remote DoS attack against systems utilizing the vulnerable version of libtasn1-3.
How To Fix
Minimum fixed version
2.13-2+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libtasn1-3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In conclusion, a vulnerability has been discovered in libtasn1-3 that could allow an attacker to cause a denial of service attack. It is crucial to upgrade your libtasn1-3 packages to the fixed version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libtasn1-3 →
FAQ
libtasn1-3 is a library that provides ASN.1 parsing and encoding functionality. It is commonly used in various applications to handle ASN.1 data structures.
Exploiting this vulnerability could lead to a remote denial of service (DoS) attack against systems using the vulnerable version of libtasn1-3.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, a security update has been released to address this vulnerability. It is recommended to upgrade your libtasn1-3 packages to version 2.13-2+deb7u5 or later.
You can find further information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for libtasn1-3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
