5.3 CVE-2024-12243

A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.
https://nvd.nist.gov/vuln/detail/CVE-2024-12243

Categories

CWE-407 : Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached. Used when the algorithmic complexity is related to the square of the number of inputs (N^2) C++ library for image metadata has "quadratic complexity" issue with unnecessarily repetitive parsing each time an invalid character is encountered Python has "quadratic complexity" issue when converting string to int with many digits in unexpected bases server allows ReDOS with crafted User-Agent strings, due to overlapping capture groups that cause excessive backtracking. Perl-based email address parser has "quadratic complexity" issue via a string that does not contain a valid address CPU consumption via inputs that cause many hash table collisions. CPU consumption via inputs that cause many hash table collisions. Product performs unnecessary processing before dropping an invalid packet. CPU and memory consumption using many wildcards. Product allows attackers to cause multiple copies of a program to be loaded more quickly than the program can detect that other copies are running, then exit. This type of error should probably have its own category, where teardown takes more time than initialization. Network monitoring system allows remote attackers to cause a denial of service (CPU consumption and detection outage) via crafted network traffic, aka a "backtracking attack." Wiki allows remote attackers to cause a denial of service (CPU consumption) by performing a diff between large, crafted pages that trigger the worst case algorithmic complexity. Wiki allows remote attackers to cause a denial of service (CPU consumption) by performing a diff between large, crafted pages that trigger the worst case algorithmic complexity. OS allows attackers to cause a denial of service (CPU consumption) via crafted Gregorian dates. Memory leak by performing actions faster than the software can clear them.

References

 

AFFECTED (from MITRE)

---

Vendor	Product	Versions
N/A	N/A	≤ 3.6.16 [affected] 3.7.0 ≤ 3.7.11 [affected] 3.8.0 < 3.8.8 [affected] 3.8.9 < * [unaffected]
Red Hat	Red Hat Enterprise Linux 8	0:3.6.16-8.el8_10.3 < * [unaffected]
Red Hat	Red Hat Enterprise Linux 8	0:3.6.16-8.el8_10.3 < * [unaffected]
Red Hat	Red Hat Enterprise Linux 9	0:3.8.3-6.el9 < * [unaffected]
Red Hat	Red Hat Enterprise Linux 9	0:3.8.3-6.el9 < * [unaffected]
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	0:3.7.6-21.el9_2.4 < * [unaffected]
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	0:3.8.3-4.el9_4.2 < * [unaffected]
Red Hat	Red Hat Discovery 1.14	sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c < * [unaffected]
Red Hat	Red Hat Discovery 1.14	sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e < * [unaffected]
Red Hat	Red Hat Enterprise Linux 10
Red Hat	Red Hat Enterprise Linux 6
Red Hat	Red Hat Enterprise Linux 7
Red Hat	Red Hat OpenShift Container Platform 4
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe	start	end

---

REMEDIATION

---

---

EXPLOITS

---

Exploit-db.com

id	description	date
No known exploits

---

POC Github

Url
No known exploits

---

Other Nist (github, ...)

Url
No known exploits

---

CAPEC

---

Common Attack Pattern Enumerations and Classifications

id	description	severity
No entry

---