Bug#1144080: gnutls28: mismege of CVE-2025-13151

[Carlos Henrique Lima Melara]

Hi,

On Mon, Aug 10, 2026 at 09:55:46PM +0200, Bastien Roucaries wrote:
> 
> CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed in
> 4.20.0)
> 
>  The fix changes:
>    char name[2 * ASN1_MAX_NAME_SIZE + 1]
> 
>  to:
>    char name[2 * ASN1_MAX_NAME_SIZE + 2]
> 
>  This applies to two functions: asn1_expand_any_defined_by and
>  asn1_expand_octet_string.
> 
> gnutls28 vendor libtasn1 internally and show a partial fix -
> asn1_expand_any_defined_by has been updated (+ 2 present) but
> 
> asn1_expand_octet_string still carries the vulnerable version (+ 1):
>    - gnutls28 (lib/minitasn1/decoding.c)
> 
>      asn1_expand_any_defined_by: patched
>      asn1_expand_octet_string: VULNERABLE
> 
> Thanks Gajendra Nath Soren

bullseye/bookworm are also affected in asn1_expand_octet_string and
buster/stretch are affected in both asn1_expand_octet_string and
asn1_expand_any_defined_by.

I don't know exactly how to deal with this case of embedded code copies
in the security-tracker so, secteam, could you assist here? (do we just
mark gnutls28 as affected by CVE-2025-13151?)

Although it has the minitasn1 code embedded, I don't think it's being
used. Looking closer, the configure script is using the distro version
[1]:

checking for libtasn1 >= 4.9... yes
checking whether to use the included minitasn1... no

Same goes for sid/forky [2], trixie [3], bookworm [1], bullseye [4],
buster[5] and stretch [6]. So I think this is a case where the
vulnerability is only in the source code and not in the built binary
(provided libtasn1 shared library has been updated with the fix).

Cheers,
Charles

[1] https://buildd.debian.org/status/fetch.php?pkg=gnutls28&arch=amd64&ver=3.7.9-2&stamp=1681563287&raw=0
[2] https://buildd.debian.org/status/fetch.php?pkg=gnutls28&arch=amd64&ver=3.8.13-1&stamp=1777616480&raw=0
[3] https://buildd.debian.org/status/fetch.php?pkg=gnutls28&arch=amd64&ver=3.8.9-3&stamp=1752060908&raw=0
[4] https://buildd.debian.org/status/fetch.php?pkg=gnutls28&arch=amd64&ver=3.7.1-5%2Bdeb11u10&stamp=1779462994&raw=0
[5] https://buildd.debian.org/status/fetch.php?pkg=gnutls28&arch=amd64&ver=3.6.7-4&stamp=1560369034&raw=0
[6] https://buildd.debian.org/status/fetch.php?pkg=gnutls28&arch=amd64&ver=3.5.8-5&stamp=1488914954&raw=0