CVE-2016-4008

CWE-399CWE-83512 documents8 sources
Severity
5.9MEDIUM
EPSS
5.0%
top 10.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
GNU Libtasn1Canonical Ubuntu LinuxFedoraproject Fedora+1 more
Timeline
PublishedMay 5
Latest updateMay 14

Description

The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages3 packages

▶Debianlibtasn1-6< 4.8-1+3
▶NVDgnu/libtasn14.7

Also affects: Fedora 22, 23, 24, Ubuntu Linux 12.04, 14.04, 15.10, 16.04

🔴Vulnerability Details

3
GHSA
GHSA-mr9j-58fj-gv7c: The _asn1_extract_der_octet function in lib/decoding↗2022-05-14
▶
OSV
CVE-2016-4008: The _asn1_extract_der_octet function in lib/decoding↗2016-05-05
▶
CVEList
CVE-2016-4008: The _asn1_extract_der_octet function in lib/decoding↗2016-05-05
▶

📋Vendor Advisories

4
Ubuntu
Libtasn1 vulnerability↗2016-05-02
▶
Ubuntu
Libtasn1 vulnerability↗2016-05-02
▶
Red Hat
libtasn1: infinite loop while parsing DER certificates↗2016-04-11
▶
Debian
CVE-2016-4008: libtasn1-6 - The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4....↗2016
▶

💬Community

4
Bugzilla
CVE-2016-4008 libtasn1: infinite loop while parsing DER certificates [fedora-all]↗2016-04-11
▶
Bugzilla
CVE-2016-4008 mingw-libtasn1: libtasn1: infinite loop while parsing DER certificates [fedora-all]↗2016-04-11
▶
Bugzilla
CVE-2016-4008 mingw-libtasn1: libtasn1: infinite loop while parsing DER certificates [epel-7]↗2016-04-11
▶
Bugzilla
CVE-2016-4008 libtasn1: infinite loop while parsing DER certificates↗2016-04-11
▶
CVE-2016-4008 (MEDIUM CVSS 5.9) | The _asn1_extract_der_octet functio | cvebase.io