CVE-2024-12243

A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.

Database specific

{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12243.json"
}

References

Affected packages

Git / gitlab.com/gnutls/gnutls

Affected ranges

Type

GIT

Repo

https://gitlab.com/gnutls/gnutls

Events

Introduced

744169a4a5421f3d0be72c70e63e7de479606ced

Introduced

df405c5e64874529b7b9dc1177165f03971dc196

Fixed

40267b5e16b5b418d7781c1c92d160a9bb12925b

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.6.16"
        },
        {
            "introduced": "3.7.0"
        },
        {
            "last_affected": "3.7.11"
        },
        {
            "introduced": "3.8.0"
        },
        {
            "fixed": "3.8.8"
        }
    ]
}

Affected versions

3.*

3.8.0

3.8.1

3.8.2

3.8.3

3.8.4

3.8.5

3.8.6

3.8.7

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-12243.json"