Bug#1144079: Mismerge of CVE-2025-13151

[Bastien Roucaries]

Source: grub2
Severity: serious
Tags: security
Justification: security
X-Debbugs-Cc: Debian Security Team <team at security.debian.org>
X-Debbugs-Cc: Gajendra Nath Soren <gajendranath025 at gmail.com>

CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed in
4.20.0)

The fix changes:
  char name[2 * ASN1_MAX_NAME_SIZE + 1]

 to:
   char name[2 * ASN1_MAX_NAME_SIZE + 2]

This applies to two functions: asn1_expand_any_defined_by and
asn1_expand_octet_string.

Grub2 vendor libtasn1 internally and show a partial fix -
asn1_expand_any_defined_by has been updated (+ 2 present) but
asn1_expand_octet_string still carries the vulnerable version (+ 1):
   - grub2 (grub-core/lib/libtasn1/lib/decoding.c)
        asn1_expand_any_defined_by: patched
     asn1_expand_octet_string: VULNERABLE
     Note: grub2 carries two separate embedded copies (libtasn1 and
 libtasn1-grub)

Thanks to Gajendra Nath Soren 

rouca


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://alioth-lists.debian.net/pipermail/pkg-grub-devel/attachments/20260810/bbc28275/attachment-0001.sig>