Read the docs
TI-2025-12022 Aliases CVE-2025-13151GHSA-f433-vfwr-65r3

Out-of-bounds write in GNU libtasn1

Priority MEDIUM 42CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 13 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0137 72nd percentileScored 2026-11-07
Fix Partial Red Hat: 16 advisoriesRed Hat: 13 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUlibtasn1up to 4.20.0—No fix listedCNA
  • libtasn1 VendorGNU Affected up to 4.20.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gnu:libtasn1:4.20.0:*:*:*:*:*:*:*4.20.0VulnerableGNU
  • cpe:2.3:a:gnu:libtasn1:4.20.0:*:*:*:*:*:*:* Versions 4.20.0 Vulnerable ·GNU

Remediation

Red Hat 16 advisories

  • RHSA-2026:82888 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82857 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82372 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
Show 13 more Red Hat advisories
  • RHSA-2026:82354 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:82347 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:72502 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:44481 Released 2026-07-23 · Red Hat rating Important
    Red Hat Update Infrastructure 5.2 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:36728 Released 2026-07-08 · Red Hat rating Low
    libtasn1 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libtasn1-devel-4.13-6.el8_10, libtasn1-tools-4.13-6.el8_10
    • Red Hat Enterprise Linux BaseOS (v. 8) libtasn1-4.13-6.el8_10
  • RHSA-2026:34102 Released 2026-07-01 · Red Hat rating Important
    Insights proxy Container Image
    • Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
  • RHSA-2026:33313 Released 2026-06-29 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:28253 Released 2026-06-23 · Red Hat rating Low
    libtasn1 security update
    • Red Hat Enterprise Linux AppStream (v. 9) libtasn1-devel-4.16.0-10.el9_8, libtasn1-tools-4.16.0-10.el9_8
    • Red Hat Enterprise Linux BaseOS (v. 9) libtasn1-4.16.0-10.el9_8
  • RHSA-2026:28235 Released 2026-06-23 · Red Hat rating Low
    libtasn1 security update
    • Red Hat Enterprise Linux AppStream (v. 10) libtasn1-devel-4.20.0-5.el10_2, libtasn1-tools-4.20.0-5.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) libtasn1-4.20.0-5.el10_2
  • RHSA-2026:7500 Released 2026-04-10 · Red Hat rating Low
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libtasn1-4.21.0-1.1.hum1@aarch64, libtasn1-4.21.0-1.1.hum1@src, libtasn1-4.21.0-1.1.hum1@x86_64 +4

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82304, RHSA-2026:82322, RHSA-2026:82888
Cert Manager support for Red Hat OpenShift release 1.18Fixed RHSA-2026:82347, RHSA-2026:82354, RHSA-2026:82372, RHSA-2026:82857
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72502
Red Hat Discovery 2Fixed RHSA-2026:33313
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:28235
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:36728
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:28253
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:28235
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:36728
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:28253
Red Hat Hardened ImagesFixed RHSA-2026:7500
Red Hat Insights proxy 1.5Fixed RHSA-2026:34102
Red Hat Update Infrastructure 5Fixed RHSA-2026:44481, RHSA-2026:58981
Not affected: 1 product
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-13151
  2. 2026-10-03 Alias added: GHSA-f433-vfwr-65r3
  3. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
  4. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  5. 2026-10-14 Fix available: RHSA-2026:82372 · Red Hat
  6. 2026-10-14 Fix available: RHSA-2026:82354 · Red Hat
  7. 2026-10-14 Fix available: RHSA-2026:82347 · Red Hat
  8. 2026-10-15 Fix available: RHSA-2026:82857 · Red Hat
  9. 2026-10-15 Fix available: RHSA-2026:82888 · Red Hat
  10. 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 · Red Hat

References

Patch 2

Advisory 1

Other 1

  • TI-2015-02477 Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote… CVSS 2.0HIGH 10.0
  • TI-2021-21531 GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der. CVSS 3.1CRITICAL 9.1
  • TI-2016-03409 The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when… CVSS 3.0MEDIUM 5.9
  • TI-2017-04623 Out-of-bounds write in Flexera Software LLC GnuTLS libtasn1 CVSS 3.1HIGH 8.8
  • TI-2015-03063 The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows… CVSS 2.0MEDIUM 4.3
  • TI-2017-07895 The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer… CVSS 3.0HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences