CVE-2017-6891 Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a spec...
HighCVSS 8.8
EPSS 5.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libtasn1-6(Debian:12) | < 4.10-1.1 | 4.10-1.1 |
| debian/libtasn1-6(Debian:13) | < 4.10-1.1 | 4.10-1.1 |
| debian/libtasn1-6(Debian:14) | < 4.10-1.1 | 4.10-1.1 |
| GNU libtasn1 | = 4.10 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| apache bookkeeper | = 4.12.1 | No fix listed |
| alpine/libtasn1(Alpine:v3.3) | < 4.7-r2 | 4.7-r2 |
| alpine/libtasn1(Alpine:v3.4) | < 4.8-r1 | 4.8-r1 |
| alpine/libtasn1(Alpine:v3.5) | < 4.9-r1 | 4.9-r1 |
| alpine/libtasn1(Alpine:v3.6) | < 4.10-r1 | 4.10-r1 |
| Flexera Software GnuTLS libtasn1 | = 4.10. Other versions may also be affected. | No fix listed |
References
- Debian Security Tracker CVE-2017-6891 vendor-advisory
- git.savannah.gnu.org
- openSUSE-SU-2019:1510 broken-link vendor-advisory
- DSA-3861 third-party-advisory vendor-advisory
- 98641 third-party-advisory vdb-entry
- 1038619 third-party-advisory vdb-entry
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list
- secuniaresearch.flexerasoftware.com permissions-required
- secuniaresearch.flexerasoftware.com patch third-party-advisory
- GLSA-201710-11 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking