Source: gnutls28 Severity: serious Tags: security Justification: security X-Debbugs-Cc: Debian Security Team <[email protected]> X-Debbugs-Cc: Gajendra Nath Soren <[email protected]>
CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed in
4.20.0)
The fix changes:
char name[2 * ASN1_MAX_NAME_SIZE + 1]
to:
char name[2 * ASN1_MAX_NAME_SIZE + 2]
This applies to two functions: asn1_expand_any_defined_by and
asn1_expand_octet_string.
gnutls28 vendor libtasn1 internally and show a partial fix -
asn1_expand_any_defined_by has been updated (+ 2 present) but
asn1_expand_octet_string still carries the vulnerable version (+ 1):
- gnutls28 (lib/minitasn1/decoding.c)
asn1_expand_any_defined_by: patched
asn1_expand_octet_string: VULNERABLE
Thanks Gajendra Nath Soren
rouca
signature.asc
Description: This is a digitally signed message part.
