Bug#1125063: libtasn1-6: CVE-2025-13151

[Moritz Mühlenhoff]

On Fri, Jan 09, 2026 at 07:17:43PM +0100, Andreas Metzler wrote:
> In order to exploit this, the target program must be using the
> asn1_expand_octet_string function explicitly with an excessively long
> name (ASN1_MAX_NAME_SIZE = 64 characters) for both the ASN.1 definition
> and the target element. Given the ASN.1 definitions are normally part of
> the application code base, it is highly unlikely to be exploitable.
> 
> https://codesearch.debian.net/ only finds 4 hits for
> asn1_expand_octet_string - libtasn1-6 itself, the libtasn copies in
> grub2 and gnutls, and a commented call in box64.
> 
> This probably does not warrant a DSA.

Thanks for following up. Agreed, this doesn't need a DSA; I'll update the
Security Tracker.

Cheers,
        Moritz