CVE-2024-12243 json
Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos
published 2025-02-10 20 mo ago modified 2026-11-05 3 d ago also EUVD-2024-50709
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 70%
- public exploits
- 0
- none known
Summary
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.
Patch / fix
- Red Hat Red Hat Enterprise Linux 8 0:3.6.16-8.el8_10.3
- Red Hat Red Hat Enterprise Linux 9 0:3.8.3-6.el9
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:3.7.6-21.el9_2.4
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:3.8.3-4.el9_4.2
- Red Hat Red Hat Discovery 1.14 1.14.2-1748467619, 1.14.3-1748529279
- Siemens RUGGEDCOM ROX MX5000 V2.17.0
- Siemens RUGGEDCOM ROX MX5000RE V2.17.0
- Siemens RUGGEDCOM ROX RX1400 V2.17.0
- Siemens RUGGEDCOM ROX RX1500 V2.17.0
- Siemens RUGGEDCOM ROX RX1501 V2.17.0
- Siemens RUGGEDCOM ROX RX1510 V2.17.0
- Siemens RUGGEDCOM ROX RX1511 V2.17.0
- Siemens RUGGEDCOM ROX RX1512 V2.17.0
- Siemens RUGGEDCOM ROX RX1524 V2.17.0
- Siemens RUGGEDCOM ROX RX1536 V2.17.0
- Siemens RUGGEDCOM ROX RX5000 V2.17.0
- gnutls28 Debian 12 3.7.9-2+deb12u4
- gnutls28 Debian 14, Debian 13 3.8.9-2
debian advisories DEBIAN-CVE-2024-12243
- gnutls28 Ubuntu 20.04 LTS 3.6.13-2ubuntu1.12
- gnutls28 Ubuntu 22.04 LTS 3.7.3-4ubuntu1.6
- gnutls28 Ubuntu 24.04 LTS 3.8.3-1.1ubuntu3.3
- gnutls28 Ubuntu Pro 18.04 LTS 3.5.18-1ubuntu1.6+esm3
- gnutls28 Ubuntu Pro FIPS-updates 22.04 LTS 3.7.3-4ubuntu1.6+Fips1
- gnutls28 Ubuntu Pro FIPS-updates 24.04 LTS 3.8.3-1.1ubuntu3.4+Fips1
ubuntu advisories UBUNTU-CVE-2024-12243
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- gnutls RHEL 9 3.8.3-6.el9
- gnutls-c++ RHEL 9 3.8.3-6.el9
- gnutls-dane RHEL 9 3.8.3-6.el9
- gnutls-utils RHEL 9 3.8.3-6.el9
- gnutls RHEL 8 3.6.16-8.el8_10.3
- gnutls-c++ RHEL 8 3.6.16-8.el8_10.3
- gnutls-dane RHEL 8 3.6.16-8.el8_10.3
- gnutls-utils RHEL 8 3.6.16-8.el8_10.3
red hat advisories RHSA-2025:17361RHSA-2025:8020RHSA-2025:7076RHSA-2025:4051
- gnutls SLE Module for Certifications 15 SP7, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 3.8.3-150600.4.6.2
- gnutls Linux Micro 6.1 3.8.3-slfo.1.1_2.1
- gnutls Linux Micro 6.0 3.8.3-3.1
- gnutls SLE Micro 5.5, SLE Micro 5.4 3.7.3-150400.4.47.1
- gnutls SLE Micro 5.3 3.7.3-150400.11.1
- gnutls SLE Micro 5.2, SLE Micro 5.1 3.6.7-150200.14.34.1
- gnutls SLES LTSS Extended Security 12 SP5 3.3.27-3.9.1
- gnutls SLES LTSS Extended Security 12 SP5 3.4.17-8.17.1
suse advisories SUSE-SU-2025:00764-1SUSE-SU-2025:20297-1SUSE-SU-2025:20157-1SUSE-SU-2025:0767-1SUSE-SU-2025:0766-1SUSE-SU-2025:0765-1
- gnutls openSUSE Tumbleweed 3.8.9-1.1
opensuse advisories openSUSE-SU-2025:14835-1
- gnutls AlmaLinux 9 3.8.3-6.el9
- gnutls-c++ AlmaLinux 9 3.8.3-6.el9
- gnutls-dane AlmaLinux 9 3.8.3-6.el9
- gnutls-utils AlmaLinux 9 3.8.3-6.el9
- gnutls AlmaLinux 8 3.6.16-8.el8_10.3
- gnutls-c++ AlmaLinux 8 3.6.16-8.el8_10.3
- gnutls-dane AlmaLinux 8 3.6.16-8.el8_10.3
- gnutls-utils AlmaLinux 8 3.6.16-8.el8_10.3
almalinux advisories ALSA-2025:7076ALSA-2025:4051
- gnutls Rocky Linux 9 3.8.3-6.el9
- gnutls Rocky Linux 8 3.6.16-8.el8_10.3
rocky linux advisories RLSA-2025:7076RLSA-2025:4051
- gnutls Alpine 3.22, Alpine 3.21, Alpine 3.20 3.8.12-r0
- gnutls Alpine 3.24, Alpine 3.23 3.8.11-r0
alpine advisories ALPINE-CVE-2024-12243
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- gnutls CBL-Mariner 2.0 3.7.11-3
- gnutls Azure Linux 3.0 3.8.3-4
azure linux advisories AZL-56752AZL-56762
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-12243 updated cvss 5.3
gnutls: GnuTLS Impacted by Inefficient DER Decoding in libtasn1 Leading to Remote DoS
-
Red Hat Enterprise Linux 6 gnutls, gnutls-guile, gnutls-utils Red Hat Enterprise Linux 7 gnutls, gnutls-c++, gnutls-dane, gnutls-utilsaffected: no fix planned “Out of support scope”
-
Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9affected: no fix available “Fix deferred”
-
Red Hat Discovery 1.14 discovery 1.14.2-1748467619, discovery 1.14.3-1748529279fixed: vendor fix RHSA-2025:8385
-
Red Hat Enterprise Linux AppStream (v. 8) gnutls-c++ 3.6.16-8.el8_10.3, gnutls-dane 3.6.16-8.el8_10.3, gnutls-utils 3.6.16-8.el8_10.3fixed: vendor fix RHSA-2025:4051
-
Red Hat Enterprise Linux AppStream (v. 9) gnutls-c++ 3.8.3-6.el9, gnutls-dane 3.8.3-6.el9, gnutls-utils 3.8.3-6.el9fixed: vendor fix RHSA-2025:7076
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) gnutls-c++ 3.7.6-21.el9_2.4, gnutls-dane 3.7.6-21.el9_2.4, gnutls-utils 3.7.6-21.el9_2.4fixed: vendor fix RHSA-2025:17361
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) gnutls-c++ 3.8.3-4.el9_4.2, gnutls-dane 3.8.3-4.el9_4.2, gnutls-utils 3.8.3-4.el9_4.2fixed: vendor fix RHSA-2025:8020
-
Red Hat Enterprise Linux BaseOS (v. 8) gnutls 3.6.16-8.el8_10.3fixed: vendor fix RHSA-2025:4051
show 4 moreshow fewer
-
Red Hat Enterprise Linux BaseOS (v. 9) gnutls 3.8.3-6.el9fixed: vendor fix RHSA-2025:7076
-
Red Hat Enterprise Linux BaseOS E4S (v.9.2) gnutls 3.7.6-21.el9_2.4fixed: vendor fix RHSA-2025:17361
-
Red Hat Enterprise Linux BaseOS EUS (v.9.4) gnutls 3.8.3-4.el9_4.2fixed: vendor fix RHSA-2025:8020
-
Red Hat Enterprise Linux 10 gnutlsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-25-162-05 updated cvss 5.3
Siemens SIMATIC S7-1500 CPU family
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5affected: mitigation, no fix available
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
1.29% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected products
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
- Red Hat Red Hat Discovery 1.14
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat OpenShift Container Platform 4
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
- Siemens RUGGEDCOM ROX MX5000
- Siemens RUGGEDCOM ROX MX5000RE
- Siemens RUGGEDCOM ROX RX1400
- Siemens RUGGEDCOM ROX RX1500
- Siemens RUGGEDCOM ROX RX1501
- Siemens RUGGEDCOM ROX RX1510
- Siemens RUGGEDCOM ROX RX1511
- Siemens RUGGEDCOM ROX RX1512
- Siemens RUGGEDCOM ROX RX1524
- Siemens RUGGEDCOM ROX RX1536
- Siemens RUGGEDCOM ROX RX5000
Classification
- Weakness
-
- CWE-407 Inefficient Algorithmic Complexity
References
-
access.redhat.com
/errata/RHSA-2025:17361
vendor-advisory
-
access.redhat.com
/errata/RHSA-2025:4051
vendor-advisory
-
access.redhat.com
/errata/RHSA-2025:7076
vendor-advisory
-
access.redhat.com
/errata/RHSA-2025:8020
vendor-advisory
-
access.redhat.com
/errata/RHSA-2025:8385
vendor-advisory
-
access.redhat.com
/security/cve/CVE-2024-12243
vdb-entry
-
bugzilla.redhat.com
/show_bug.cgi?id=2344615
issue-tracking
- gitlab.com /gnutls/gnutls/-/issues/1553
- gitlab.com /gnutls/libtasn1/-/issues/52
- lists.debian.org /debian-lts-announce/2025/02/msg00027.html
- security.netapp.com /advisory/ntap-20250523-0002/
- cert-portal.siemens.com /productcert/html/ssa-082556.html
- cert-portal.siemens.com /productcert/html/ssa-202008.html
Sources
- CVE List CVE-2024-12243
- NVD CVE-2024-12243
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.