Bug#1144080: gnutls28: mismege of CVE-2025-13151

[Bastien Roucaries]

Source: gnutls28
Severity: serious
Tags: security
Justification: security
X-Debbugs-Cc: Debian Security Team <team at security.debian.org>
X-Debbugs-Cc:  Gajendra Nath Soren <gajendranath025 at gmail.com>

CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed in
4.20.0)

 The fix changes:
   char name[2 * ASN1_MAX_NAME_SIZE + 1]

 to:
   char name[2 * ASN1_MAX_NAME_SIZE + 2]

 This applies to two functions: asn1_expand_any_defined_by and
 asn1_expand_octet_string.

gnutls28 vendor libtasn1 internally and show a partial fix -
asn1_expand_any_defined_by has been updated (+ 2 present) but

asn1_expand_octet_string still carries the vulnerable version (+ 1):
   - gnutls28 (lib/minitasn1/decoding.c)

     asn1_expand_any_defined_by: patched
     asn1_expand_octet_string: VULNERABLE

Thanks Gajendra Nath Soren

rouca

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnutls-maint/attachments/20260810/44f193b3/attachment.sig>