CVE-2024-12243: Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos
Siemens · gnutls
Vendor fix available · Affected: Siemens gnutls · Exploitation: possible (1 to 10%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 70% of scored CVEs
DescriptionCVE.org
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.
Affected products13
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- gnutlsup to and including 3.6.16; from 3.7.0 up to and including 3.7.11; from 3.8.0 before 3.8.8
- Red Hat · Red Hat Enterprise Linux 8Versions not stated
- Red Hat · Red Hat Enterprise Linux 8Versions not stated
- Red Hat · Red Hat Enterprise Linux 9Versions not stated
- Red Hat · Red Hat Enterprise Linux 9Versions not stated
- Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsVersions not stated
- Red Hat · Red Hat Enterprise Linux 9.4 Extended Update SupportVersions not stated
- Red Hat · Red Hat Discovery 1.14Versions not stated
- Red Hat · Red Hat Discovery 1.14Versions not stated
- Red Hat · Red Hat Enterprise Linux 10Versions not stated
- Red Hat · Red Hat Enterprise Linux 6Versions not stated
- Red Hat · Red Hat Enterprise Linux 7Versions not stated
- Red Hat · Red Hat OpenShift Container Platform 4Versions not stated
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Siemens
- Published
- February 2025
CoverageNo articles yet
No CyberSIXT article names CVE-2024-12243 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.
References
- NVD entrynvd.nist.gov
- CVE recordcve.org
- Weakness CWE-407cwe.mitre.org
- Vendor advisoryaccess.redhat.com
- Vendor advisoryaccess.redhat.com
- Vendor advisoryaccess.redhat.com
- Vendor advisoryaccess.redhat.com
- Vendor advisoryaccess.redhat.com
- access.redhat.com/security/cve/CVE-2024-12243access.redhat.com
- Issue trackerbugzilla.redhat.com
- gitlab.com/gnutls/gnutls/-/issues/1553gitlab.com
- gitlab.com/gnutls/libtasn1/-/issues/52gitlab.com
- lists.debian.org/debian-lts-announce/2025/02/msg00027.htmllists.debian.org
- security.netapp.com/advisory/ntap-20250523-0002security.netapp.com
- cert-portal.siemens.com/productcert/html/ssa-082556.htmlcert-portal.siemens.com
1 more reference is in the CVE record.