[gnutls-devel] GnuTLS | Mismerge of fix of CVE-2025-13151 (#1932)

[(Deprecated) Read-only notification of GnuTLS library development activities]

Issue created by bastien roucaries: https://gitlab.com/gnutls/gnutls/-/work_items/1932



CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed in
4.20.0)

 The fix changes:
   char name[2 * ASN1_MAX_NAME_SIZE + 1]

 to:
   char name[2 * ASN1_MAX_NAME_SIZE + 2]

 This applies to two functions: asn1_expand_any_defined_by and
 asn1_expand_octet_string.

gnutls28 vendor libtasn1 internally and show a partial fix -
asn1_expand_any_defined_by has been updated (+ 2 present) but

asn1_expand_octet_string still carries the vulnerable version (+ 1):
   - gnutls28 (lib/minitasn1/decoding.c)

     asn1_expand_any_defined_by: patched
     asn1_expand_octet_string: VULNERABLE

Thanks Gajendra Nath Soren

rouca

link: [[https://bugs.debian.org/1144080]]

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1932
You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/namespace/17175643/sent_notifications/6-cojk2mdhhzk0g2r8r4cmr5j2g-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20260811/e2743829/attachment-0003.html>