Skip to content
Fencer Vulns
medium 5.3

CVE-2024-12133 json

Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos

published 2025-02-10 20 mo ago modified 2026-11-05 4 d ago also EUVD-2024-50622

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 8 0:4.13-5.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:3.6.14-10.el8_4.1, 0:4.13-3.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:3.6.14-10.el8_4.1, 0:4.13-3.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:3.6.16-5.el8_6.5, 0:4.13-3.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:3.6.16-5.el8_6.5, 0:4.13-3.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:3.6.16-7.el8_8.4, 0:4.13-4.el8_8.1
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:3.6.16-7.el8_8.4, 0:4.13-4.el8_8.1
  • Red Hat Red Hat Enterprise Linux 9 0:4.16.0-9.el9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:4.16.0-8.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:4.16.0-8.el9_4.1
  • Red Hat Red Hat Discovery 1.14 1.14.2-1748467619, 1.14.3-1748529279
  • Siemens RUGGEDCOM ROX MX5000 V2.17.0
  • Siemens RUGGEDCOM ROX MX5000RE V2.17.0
  • Siemens RUGGEDCOM ROX RX1400 V2.17.0
  • Siemens RUGGEDCOM ROX RX1500 V2.17.0
  • Siemens RUGGEDCOM ROX RX1501 V2.17.0
  • Siemens RUGGEDCOM ROX RX1510 V2.17.0
  • Siemens RUGGEDCOM ROX RX1511 V2.17.0
  • Siemens RUGGEDCOM ROX RX1512 V2.17.0
  • Siemens RUGGEDCOM ROX RX1524 V2.17.0
  • Siemens RUGGEDCOM ROX RX1536 V2.17.0
  • Siemens RUGGEDCOM ROX RX5000 V2.17.0
  • libtasn1-6 Debian 12 4.19.0-2+deb12u1
  • libtasn1-6 Debian 14, Debian 13 4.20.0-1

debian advisories DEBIAN-CVE-2024-12133

  • libtasn1-6 Ubuntu 20.04 LTS 4.16.0-2ubuntu0.1
  • libtasn1-6 Ubuntu 22.04 LTS 4.18.0-4ubuntu0.1
  • libtasn1-6 Ubuntu 24.04 LTS 4.19.0-3ubuntu0.24.04.1

ubuntu advisories UBUNTU-CVE-2024-12133

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libtasn1 RHEL 9 4.16.0-9.el9
  • libtasn1-tools RHEL 9 4.16.0-9.el9
  • libtasn1 RHEL 8 4.13-5.el8_10
  • libtasn1-tools RHEL 8 4.13-5.el8_10
  • gnutls RHEL 8.4 EUS_LONG_LIFE, RHEL 8.4 AUS 3.6.14-10.el8_4.1
  • libtasn1 RHEL 8.4 EUS_LONG_LIFE, RHEL 8.4 AUS 4.13-3.el8_4.1
  • gnutls-c++ RHEL 8.4 EUS_LONG_LIFE, RHEL 8.4 AUS 3.6.14-10.el8_4.1
  • gnutls-dane RHEL 8.4 EUS_LONG_LIFE, RHEL 8.4 AUS 3.6.14-10.el8_4.1

red hat advisories RHSA-2026:33125RHSA-2026:30850RHSA-2026:30849RHSA-2025:17347RHSA-2025:8021RHSA-2025:7077

  • libtasn1 Linux Micro 6.1 4.19.0-slfo.1.1_2.1
  • libtasn1 Linux Micro 6.0 4.19.0-4.1
  • libtasn1 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +18 more 4.13-150000.4.11.1
  • libtasn1 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 4.9-3.16.1

suse advisories SUSE-SU-2025:20275-1SUSE-SU-2025:20171-1SUSE-SU-2025:0548-1SUSE-SU-2025:0512-1

  • gnutls openSUSE Tumbleweed 3.8.9-1.1
  • libtasn1 openSUSE Tumbleweed 4.20.0-1.1

opensuse advisories openSUSE-SU-2025:14835-1openSUSE-SU-2025:14756-1

  • libtasn1 AlmaLinux 9 4.16.0-9.el9
  • libtasn1-tools AlmaLinux 9 4.16.0-9.el9
  • libtasn1 AlmaLinux 8 4.13-5.el8_10
  • libtasn1-tools AlmaLinux 8 4.13-5.el8_10

almalinux advisories ALSA-2025:7077ALSA-2025:4049

  • libtasn1 Rocky Linux 9 4.16.0-9.el9
  • libtasn1 Rocky Linux 8 4.13-5.el8_10

rocky linux advisories RLSA-2025:7077RLSA-2025:4049

  • libtasn1 Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 4.20.0-r0

alpine advisories ALPINE-CVE-2024-12133

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libtasn1 CBL-Mariner 2.0, Azure Linux 3.0 4.19.0-2
  • gnutls Azure Linux 3.0 3.8.3-4
  • gnutls CBL-Mariner 2.0 3.7.11-2

azure linux advisories AZL-56705AZL-56720AZL-56758AZL-56767

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-12133 updated cvss 5.3

libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS

  • Red Hat Enterprise Linux 6 libtasn1, libtasn1-tools Red Hat Enterprise Linux 7 libtasn1, libtasn1-tools
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9
    affected: no fix available “Fix deferred”
  • Red Hat Discovery 1.14 discovery 1.14.2-1748467619, discovery 1.14.3-1748529279
    fixed: vendor fix RHSA-2025:8385
  • Red Hat Enterprise Linux AppStream (v. 8) libtasn1-tools 4.13-5.el8_10
    fixed: vendor fix RHSA-2025:4049
  • Red Hat Enterprise Linux AppStream (v. 9) libtasn1-tools 4.16.0-9.el9
    fixed: vendor fix RHSA-2025:7077
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) gnutls-c++ 3.6.14-10.el8_4.1, gnutls-dane 3.6.14-10.el8_4.1, libtasn1-tools 4.13-3.el8_4.1, gnutls-utils 3.6.14-10.el8_4.1
    fixed: vendor fix RHSA-2026:33125
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) gnutls-c++ 3.6.16-5.el8_6.5, gnutls-dane 3.6.16-5.el8_6.5, gnutls-utils 3.6.16-5.el8_6.5, libtasn1-tools 4.13-3.el8_6.2
    fixed: vendor fix RHSA-2026:30849
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) gnutls-c++ 3.6.16-7.el8_8.4, gnutls-dane 3.6.16-7.el8_8.4, gnutls-utils 3.6.16-7.el8_8.4, libtasn1-tools 4.13-4.el8_8.1
    fixed: vendor fix RHSA-2026:30850
show 16 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) libtasn1-tools 4.16.0-8.el9_2.1
    fixed: vendor fix RHSA-2025:17347
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) libtasn1-tools 4.16.0-8.el9_4.1
    fixed: vendor fix RHSA-2025:8021
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) gnutls-c++ 3.6.14-10.el8_4.1, gnutls-dane 3.6.14-10.el8_4.1, libtasn1-tools 4.13-3.el8_4.1, gnutls-utils 3.6.14-10.el8_4.1
    fixed: vendor fix RHSA-2026:33125
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) gnutls-c++ 3.6.16-5.el8_6.5, gnutls-dane 3.6.16-5.el8_6.5, gnutls-utils 3.6.16-5.el8_6.5, libtasn1-tools 4.13-3.el8_6.2
    fixed: vendor fix RHSA-2026:30849
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) gnutls-c++ 3.6.16-7.el8_8.4, gnutls-dane 3.6.16-7.el8_8.4, gnutls-utils 3.6.16-7.el8_8.4, libtasn1-tools 4.13-4.el8_8.1
    fixed: vendor fix RHSA-2026:30850
  • Red Hat Enterprise Linux BaseOS (v. 8) libtasn1 4.13-5.el8_10
    fixed: vendor fix RHSA-2025:4049
  • Red Hat Enterprise Linux BaseOS (v. 9) libtasn1 4.16.0-9.el9
    fixed: vendor fix RHSA-2025:7077
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libtasn1 4.13-3.el8_4.1, gnutls 3.6.14-10.el8_4.1
    fixed: vendor fix RHSA-2026:33125
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) gnutls 3.6.16-5.el8_6.5, libtasn1 4.13-3.el8_6.2
    fixed: vendor fix RHSA-2026:30849
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) gnutls 3.6.16-7.el8_8.4, libtasn1 4.13-4.el8_8.1
    fixed: vendor fix RHSA-2026:30850
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libtasn1 4.16.0-8.el9_2.1
    fixed: vendor fix RHSA-2025:17347
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libtasn1 4.16.0-8.el9_4.1
    fixed: vendor fix RHSA-2025:8021
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libtasn1 4.13-3.el8_4.1, gnutls 3.6.14-10.el8_4.1
    fixed: vendor fix RHSA-2026:33125
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) gnutls 3.6.16-5.el8_6.5, libtasn1 4.13-3.el8_6.2
    fixed: vendor fix RHSA-2026:30849
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) gnutls 3.6.16-7.el8_8.4, libtasn1 4.13-4.el8_8.1
    fixed: vendor fix RHSA-2026:30850
  • Red Hat Enterprise Linux 10 libtasn1 Red Hat Enterprise Linux AppStream AUS (v.8.4) gnutls-utils-debuginfo 3.6.14-10.el8_4.1 Red Hat Enterprise Linux AppStream AUS (v.8.6) gnutls-c++-debuginfo 3.6.16-5.el8_6.5 Red Hat Enterprise Linux AppStream E4S (v.8.8) gnutls-c++-debuginfo 3.6.16-7.el8_8.4 Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) gnutls-utils-debuginfo 3.6.14-10.el8_4.1 Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) gnutls-c++-debuginfo 3.6.16-5.el8_6.5
    +7 more products
    Red Hat Enterprise Linux AppStream TUS (v.8.8) gnutls-c++-debuginfo 3.6.16-7.el8_8.4 Red Hat Enterprise Linux BaseOS AUS (v.8.4) gnutls-utils-debuginfo 3.6.14-10.el8_4.1 Red Hat Enterprise Linux BaseOS AUS (v.8.6) gnutls-c++-debuginfo 3.6.16-5.el8_6.5 Red Hat Enterprise Linux BaseOS E4S (v.8.8) gnutls-c++-debuginfo 3.6.16-7.el8_8.4 Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) gnutls-utils-debuginfo 3.6.14-10.el8_4.1 Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) gnutls-c++-debuginfo 3.6.16-5.el8_6.5 Red Hat Enterprise Linux BaseOS TUS (v.8.8) gnutls-c++-debuginfo 3.6.16-7.el8_8.4
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-162-05 updated cvss 5.3

Siemens SIMATIC S7-1500 CPU family

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Discovery 1.14
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat OpenShift Container Platform 4
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens RUGGEDCOM ROX MX5000
  • Siemens RUGGEDCOM ROX MX5000RE
  • Siemens RUGGEDCOM ROX RX1400
  • Siemens RUGGEDCOM ROX RX1500
  • Siemens RUGGEDCOM ROX RX1501
  • Siemens RUGGEDCOM ROX RX1510
  • Siemens RUGGEDCOM ROX RX1511
  • Siemens RUGGEDCOM ROX RX1512
  • Siemens RUGGEDCOM ROX RX1524
  • Siemens RUGGEDCOM ROX RX1536
  • Siemens RUGGEDCOM ROX RX5000

Classification

Weakness
  • CWE-407 Inefficient Algorithmic Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.