Bug#1144080: gnutls28: mismege of CVE-2025-13151
Bastien Roucaries <[email protected]>
| Newsgroups | gmane.linux.debian.devel.bugs.rc |
|---|---|
| Message-ID | <5694425.tWeucmBOSa__4618.23565872095$1786391835$gmane$org@debian-ei> |
Source: gnutls28 Severity: serious Tags: security Justification: security X-Debbugs-Cc: Debian Security Team <[email protected]> X-Debbugs-Cc: Gajendra Nath Soren <[email protected]> CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed in 4.20.0) The fix changes: char name[2 * ASN1_MAX_NAME_SIZE + 1] to: char name[2 * ASN1_MAX_NAME_SIZE + 2] This applies to two functions: asn1_expand_any_defined_by and asn1_expand_octet_string. gnutls28 vendor libtasn1 internally and show a partial fix - asn1_expand_any_defined_by has been updated (+ 2 present) but asn1_expand_octet_string still carries the vulnerable version (+ 1): - gnutls28 (lib/minitasn1/decoding.c) asn1_expand_any_defined_by: patched asn1_expand_octet_string: VULNERABLE Thanks Gajendra Nath Soren rouca
signature.asc
(application/pgp-signature, 833 B)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmp6LKUACgkQADoaLapB CF+dHRAAiLNNae6J/qhnM/kVmZU+NRhCUyBHvj8dVFtbkC+eP6G4iF9NKKhxWkJm wUNXPyG2a9dctHip95WIrn8PD461iiPZXPPBnfxQFM+e/qmrN8XRUjYV2SCBSliE 23jqhBh0xwiIm3gVIz2wqF71Ql/zs5cPKWy3lNB6F6cvdJpHTvLB8tir2UfSB1PF mCTyWFqQGvt3IlCwX8jrVDAOq8sqeQt6mnR8Z891ZFwF9j+oq6+JC6QeGkoC5jC4 nVWudh0QfBxFeg99l4Ag+dCfcb79QwHEJqNxRrh7BV8bh4HQx9QlvBTFYgtmr7h2 4oyvU2aNMShPWb5UgVl33KNqANTPe4bM/GLUMcqJEja7KMwBf3JCZnx/H+qc7Evh TAu013TV0B82ldOxdtgk3sSaT7sxU/bjCwNfkLZPNLQMj7FJe9vy1Poei4BP1qhG BidyEpt0q8ho4SADeYRwu3xCCVqKKOi3aUguboT0+qzBf6Y1uHOxsf2aod1oZgSc Xer6UnjSSlI7f63Omd5AhS/IxJs8cez0IaGCEzKIBuAsvtTZ/PeUdQSGH27/Hjlo S7stixF3exQwow/QxU3ceqY4KhfCOwowJQEOQPPgJdPEFTV0IFpGDppUV3QLJB6z ZNIVhhlIz9tGXH1nZW67ZYddWlc4Rx4lbOqaU1HBejhIoLfFdxs= =R8zW -----END PGP SIGNATURE-----