{"id":"CVE-2012-1569","aliases":["DEBIAN-CVE-2012-1569","DSA-2440-1","EUVD-2012-1587","GHSA-jcv4-2hjq-vv2c","RHSA-2012:0427","RHSA-2012:0428","RHSA-2012:0531","openSUSE-SU-2024:10105-1"],"status":"published","title":"The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS...","description":"The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0441,"percentile":0.91398,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2012-03-24T00:00:00Z","modified":"2026-06-28T10:06:08Z","fixes":[{"ecosystem":"Debian:6.0","package":"libtasn1-3","fixed_in":["2.7-1+squeeze+1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1-debuginfo","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1-devel","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1-tools","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1-debuginfo","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1-devel","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1-tools","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1-debuginfo","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1-devel","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1-tools","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1-debuginfo","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1-devel","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1-tools","fixed_in":["0:2.3-3.el6_2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"libtasn1-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-1+squeeze+1"}]}],"versions":["2.7-1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-3.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-7.el5_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-7.el5_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-7.el5_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-7.el5_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-7.el5_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-7.el5_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-7.el5_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-7.el5_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-7.el5_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-7.el5_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"rhev-hypervisor6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2-20120423.1.el6_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"rhev-hypervisor6-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2-20120423.1.el6_2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.15-1.1"}]}],"bundled":10}],"products":[{"vendor":"gnu","product":"gnutls"},{"vendor":"gnu","product":"libtasn1"}],"references":[{"url":"http://secunia.com/advisories/57260","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0427.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://secunia.com/advisories/48578","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0531.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://secunia.com/advisories/49002","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077339.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2012/03/20/8","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2012/03/21/5","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://secunia.com/advisories/48488","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-1436-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-April/076865.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077284.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.gnu.org/software/gnutls/security.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=804920","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0488.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-April/076856.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5932","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch"]},{"url":"http://www.securitytracker.com/id?1026829","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://linux.oracle.com/errata/ELSA-2014-0596.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/48596","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/50739","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/48397","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/48505","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://article.gmane.org/gmane.comp.gnu.libtasn1.general/53","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://article.gmane.org/gmane.comp.gnu.libtasn1.general/54","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2012/03/20/3","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.debian.org/security/2012/dsa-2440","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:039","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076699.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078207.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-1569","tags":["advisory"]},{"url":"http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns"},{"url":"https://github.com/advisories/GHSA-jcv4-2hjq-vv2c"},{"url":"https://access.redhat.com/errata/RHSA-2012:0427","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0427.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-1569","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-1569","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2012:0428","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=752308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=805432","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0428.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-4128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-4128","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4128","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-1573","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-1573","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-1573","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2012:0531","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=794766","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0531.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-0864","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-0864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0864","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6251","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-1569","description":"The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.","status":"published","published":"2012-03-26T19:00:00Z","modified":"2024-08-06T19:01:02.196Z","updated_at":"2026-11-02T14:34:52.27879Z"}],"euvd":[{"id":"EUVD-2012-1587","description":"The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.","status":"published","published":"2012-03-26T19:00:00Z","modified":"2024-08-06T19:01:02Z","updated_at":"2026-11-03T01:56:17.940678Z"}],"ghsa":[{"id":"GHSA-jcv4-2hjq-vv2c","title":"The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS...","description":"The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.","status":"published","published":"2022-05-14T03:49:27Z","modified":"2025-04-11T03:56:31Z","updated_at":"2026-11-02T15:01:10.591916Z"}],"nvd":[{"id":"CVE-2012-1569","description":"The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.","status":"published","published":"2012-03-26T19:55:01.11Z","modified":"2026-06-16T23:39:44.783Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:13.901526Z"}],"osv":[{"id":"DSA-2440-1","title":"libtasn1-3 - integer overflow","status":"published","published":"2012-03-24T00:00:00Z","modified":"2026-03-09T01:20:37.217151Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"openSUSE-SU-2024:10105-1","title":"gnutls-3.4.15-1.1 on GA media","description":"These are all security issues fixed in the gnutls-3.4.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:28.673202Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2012:0427","title":"Red Hat Security Advisory: libtasn1 security update","status":"published","published":"2024-09-13T07:59:21Z","modified":"2026-06-28T10:05:58Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2012:0428","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-15T19:50:01Z","modified":"2026-06-28T10:05:58Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2012:0531","title":"Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update","status":"published","published":"2024-09-13T07:59:17Z","modified":"2026-06-28T10:06:08Z","updated_at":"2026-11-02T15:53:01.495018Z"}]}}