CVE-2018-1000654
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically...
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
- Record
CVE-2018-1000654- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:N/I:N/A:C - Updated
- 2026-11-02
CVE List No score
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
- Record
CVE-2018-1000654- Updated
- 2026-11-02
EUVDEUVD-2018-1985 No score
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
- Record
EUVD-2018-1985- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g69v-w5wh-rhwv
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically...
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
- Record
GHSA-g69v-w5wh-rhwv- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALPINE-CVE-2018-1000654
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
- Record
ALPINE-CVE-2018-1000654- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2018-1000654
CVE-2018-1000654 does not affect BellSoft software
- Record
BELL-CVE-2018-1000654- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSV
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
- Record
CVE-2018-1000654- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1000654
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
- Record
DEBIAN-CVE-2018-1000654- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1000654
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
- Record
UBUNTU-CVE-2018-1000654- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0359 No score
Updated libtasn1 packages fix security vulnerability
Updated libtasn1 packages fix security vulnerability:
Denial of service in asn1Parser (CVE-2018-1000654).
- Record
MGASA-2019-0359- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1498-1 No score
Security update for libtasn1
This update for libtasn1 fixes the following issues:
Security issue fixed:
- CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1498-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11001-1 No score
libtasn1-6-32bit-4.17.0-1.2 on GA media
These are all security issues fixed in the libtasn1-6-32bit-4.17.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11001-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1372-1 No score
Security update for libtasn1
This update for libtasn1 fixes the following issues:
Security issue fixed:
- CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).
- Record
SUSE-SU-2019:1372-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1372-2 No score
Security update for libtasn1
This update for libtasn1 fixes the following issues:
Security issue fixed:
- CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).
- Record
SUSE-SU-2019:1372-2- Updated
- 2026-11-02
OSVSUSE-SU-2019:1379-1 No score
Security update for libtasn1
This update for libtasn1 fixes the following issues:
Security issues fixed:
- CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).
- CVE-2017-6891: Fixed a stack overflow in asn1_find_node() (bsc#1040621).
- Record
SUSE-SU-2019:1379-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3797-1 No score
Security update for libtasn1
This update for libtasn1 fixes the following issues:
Security issue fixed:
- CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).
- CVE-2017-6891: Added safety check to fix a stack overflow issue (bsc#1040621).
- CVE-2021-46848: Fixed off-by-one array size check that affects asn1_encode_simple_der (bsc#1204690)
- Record
SUSE-SU-2022:3797-1- Updated
- 2026-11-02
OSVUSN-5352-1 No score
libtasn1-6 vulnerability
It was discovered that Libtasn1 incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service.
- Record
USN-5352-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libtasn1Alpine:v3.10 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.11 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.12 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.13 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.14 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.15 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.16 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.17 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.18 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.19 |
before 4.14-r0 | 4.14-r0 |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libtasn1Alpine:v3.20 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.21 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.22 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.23 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.24 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.7 |
before 4.12-r4 | 4.12-r4 |
libtasn1Alpine:v3.8 |
before 4.14-r0 | 4.14-r0 |
libtasn1Alpine:v3.9 |
before 4.14-r0 | 4.14-r0 |
libtasn1-6Debian:12 |
before 4.14-2 | 4.14-2 |
libtasn1-6Debian:13 |
before 4.14-2 | 4.14-2 |
libtasn1-6Debian:14 |
before 4.14-2 | 4.14-2 |
libtasn1Mageia:7 |
before 4.14-1.mga7 | 4.14-1.mga7 |
libtasn1SUSE:Linux Enterprise Module for Basesystem 15 |
before 4.13-4.5.1 | 4.13-4.5.1 |
libtasn1SUSE:Linux Enterprise Module for Desktop Applications 15 |
before 4.13-4.5.1 | 4.13-4.5.1 |
libtasn1SUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 4.13-4.5.1 | 4.13-4.5.1 |
libtasn1SUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 2 CVEs |
before 4.9-3.10.1 | 4.9-3.10.1 |
libtasn1SUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 2 CVEs |
before 4.9-3.10.1 | 4.9-3.10.1 |
libtasn1SUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 2 CVEs |
before 4.9-3.10.1 | 4.9-3.10.1 |
libtasn1SUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 2 CVEs |
before 4.9-3.10.1 | 4.9-3.10.1 |
libtasn1SUSE:Linux Enterprise Server 12 SP3 From an advisory covering 2 CVEs |
before 4.9-3.10.1 | 4.9-3.10.1 |
libtasn1SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 2 CVEs |
before 4.9-3.10.1 | 4.9-3.10.1 |
libtasn1SUSE:Linux Enterprise Server 12 SP4 From an advisory covering 2 CVEs |
before 4.9-3.10.1 | 4.9-3.10.1 |
libtasn1SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 2 CVEs |
before 4.9-3.10.1 | 4.9-3.10.1 |
libtasn1SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 3 CVEs |
before 3.7-13.7.1 | 3.7-13.7.1 |
libtasn1-6Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.3-23.4-23.4-33.4-3ubuntu0.13.4-3ubuntu0.2 Show 5 moreShow less3.4-3ubuntu0.33.4-3ubuntu0.43.4-3ubuntu0.53.4-3ubuntu0.63.4-3ubuntu0.6+esm1 |
None known |
libtasn1-6Ubuntu:Pro:16.04:LTS |
before 4.7-3ubuntu0.16.04.3+esm2, plus listed versions 4.5-24.7-24.7-34.7-3ubuntu0.16.04.14.7-3ubuntu0.16.04.24.7-3ubuntu0.16.04.3 |
4.7-3ubuntu0.16.04.3+esm2 |
libtasn1-6Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.12-2.14.12-34.13-24.13-2ubuntu0.1~esm1 |
None known |
libtasn1openSUSE:Leap 15.0 |
before 4.13-lp151.4.3.1 | 4.13-lp151.4.3.1 |
libtasn1openSUSE:Leap 15.1 |
before 4.13-lp151.4.3.1 | 4.13-lp151.4.3.1 |
libtasn1openSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 4.17.0-1.2 | 4.17.0-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000654 is a medium vulnerability (CVSS 5.5) in Gnu Libtasn1, published August 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.98%, the 80th percentile. Fixed in libtasn1 4.14-r0.
References
gitlab.com/gnutls/libtasn1/issues/4
securityfocus.com/bid/105151
lists.opensuse.org/opensuse-security-announce/2019-06/msg00009.html
lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2018-1000654
Show 23 moreShow less
github.com/advisories/GHSA-g69v-w5wh-rhwv
security.alpinelinux.org/vuln/CVE-2018-1000654
docs.bell-sw.com/security/cves/CVE-2018-1000654
security-tracker.debian.org/tracker/CVE-2018-1000654
advisories.mageia.org/MGASA-2019-0359.html
bugs.mageia.org/show_bug.cgi?id=25744
suse.com/support/update/announcement/2019/suse-su-20191372-1
bugzilla.suse.com/1105435
ubuntu.com/security/CVE-2018-1000654
cve.org/CVERecord?id=CVE-2018-1000654