Skip to content

Commit 2cbbe9e

Browse files
azurelinux-securityKanishk-Bansal
azurelinux-security
and
Kanishk-Bansal
authored
[AutoPR- Security] Patch libtasn1 for CVE-2025-13151 [LOW] (#15485)
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent 101af2e commit 2cbbe9e

6 files changed

Lines changed: 55 additions & 10 deletions

File tree

‎SPECS/libtasn1/CVE-2025-13151.patch‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
From 19c67d35287ca30929e0f4353cdc1b89de1ae75e Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Mon, 12 Jan 2026 16:41:34 +0000
4+
Subject: [PATCH] Fix for CVE-2025-13151: prevent stack-based buffer overflow
5+
in asn1_expand_octet_string; update NEWS
6+
7+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
8+
Upstream-reference: AI Backport of https://gitlab.com/gnutls/libtasn1/-/commit/d276cc495a2a32b182c3c39851f1ba58f2d9f9b8.patch
9+
---
10+
NEWS | 1 +
11+
lib/decoding.c | 2 +-
12+
2 files changed, 2 insertions(+), 1 deletion(-)
13+
14+
diff --git a/NEWS b/NEWS
15+
index cbd09eb..2100e6f 100644
16+
--- a/NEWS
17+
+++ b/NEWS
18+
@@ -4,6 +4,7 @@ GNU Libtasn1 NEWS -*- outline -*-
19+
- Clarify libtasn1.map license. Closes: #38.
20+
- Fix ETYPE_OK out of bounds read. Closes: #32.
21+
- Update gnulib files and various maintenance fixes.
22+
+- Fix for vulnerbaility CVE-2025-13151 Stack-based buffer overflow
23+
24+
* Noteworthy changes in release 4.18.0 (2021-11-09) [stable]
25+
- Improve GTK-DOC manual. Closes: #35.
26+
diff --git a/lib/decoding.c b/lib/decoding.c
27+
index b9245c4..bc45138 100644
28+
--- a/lib/decoding.c
29+
+++ b/lib/decoding.c
30+
@@ -1976,7 +1976,7 @@ int
31+
asn1_expand_octet_string (asn1_node_const definitions, asn1_node * element,
32+
const char *octetName, const char *objectName)
33+
{
34+
- char name[2 * ASN1_MAX_NAME_SIZE + 1], value[ASN1_MAX_NAME_SIZE];
35+
+ char name[2 * ASN1_MAX_NAME_SIZE + 2], value[ASN1_MAX_NAME_SIZE];
36+
int retCode = ASN1_SUCCESS, result;
37+
int len, len2, len3;
38+
asn1_node_const p2;
39+
--
40+
2.45.4
41+

‎SPECS/libtasn1/libtasn1.spec‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
Summary: ASN.1 library
22
Name: libtasn1
33
Version: 4.19.0
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: GPLv3+ AND LGPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
88
Group: System Environment/Libraries
99
URL: https://www.gnu.org/software/libtasn1/
1010
Source0: https://ftp.gnu.org/gnu/libtasn1/%{name}-%{version}.tar.gz
1111
Patch0: CVE-2024-12133.patch
12+
Patch1: CVE-2025-13151.patch
1213
Provides: libtasn1-tools = %{version}-%{release}
1314

1415
%description
@@ -58,7 +59,10 @@ make %{?_smp_mflags} check
5859
%{_mandir}/man3/*
5960

6061
%changelog
61-
* Fri Feb 21 2024 Ankita Pareek <ankitapareek@microsoft.com> - 4.19.0-2
62+
* Mon Jan 12 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 4.19.0-3
63+
- Patch for CVE-2025-13151
64+
65+
* Fri Feb 21 2025 Ankita Pareek <ankitapareek@microsoft.com> - 4.19.0-2
6266
- Address CVE-2024-12133
6367

6468
* Tue Oct 25 2022 Pawel Winogrodzki <pawelwi@microsoft.com> - 4.19.0-1

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -235,7 +235,7 @@ azurelinux-repos-shared-3.0-5.azl3.noarch.rpm
235235
azurelinux-repos-3.0-5.azl3.noarch.rpm
236236
libffi-3.4.4-1.azl3.aarch64.rpm
237237
libffi-devel-3.4.4-1.azl3.aarch64.rpm
238-
libtasn1-4.19.0-2.azl3.aarch64.rpm
238+
libtasn1-4.19.0-3.azl3.aarch64.rpm
239239
p11-kit-0.25.0-1.azl3.aarch64.rpm
240240
p11-kit-trust-0.25.0-1.azl3.aarch64.rpm
241241
ca-certificates-shared-3.0.0-14.azl3.noarch.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -235,7 +235,7 @@ azurelinux-repos-shared-3.0-5.azl3.noarch.rpm
235235
azurelinux-repos-3.0-5.azl3.noarch.rpm
236236
libffi-3.4.4-1.azl3.x86_64.rpm
237237
libffi-devel-3.4.4-1.azl3.x86_64.rpm
238-
libtasn1-4.19.0-2.azl3.x86_64.rpm
238+
libtasn1-4.19.0-3.azl3.x86_64.rpm
239239
p11-kit-0.25.0-1.azl3.x86_64.rpm
240240
p11-kit-trust-0.25.0-1.azl3.x86_64.rpm
241241
ca-certificates-shared-3.0.0-14.azl3.noarch.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -234,9 +234,9 @@ libssh2-debuginfo-1.11.1-1.azl3.aarch64.rpm
234234
libssh2-devel-1.11.1-1.azl3.aarch64.rpm
235235
libstdc++-13.2.0-7.azl3.aarch64.rpm
236236
libstdc++-devel-13.2.0-7.azl3.aarch64.rpm
237-
libtasn1-4.19.0-2.azl3.aarch64.rpm
238-
libtasn1-debuginfo-4.19.0-2.azl3.aarch64.rpm
239-
libtasn1-devel-4.19.0-2.azl3.aarch64.rpm
237+
libtasn1-4.19.0-3.azl3.aarch64.rpm
238+
libtasn1-debuginfo-4.19.0-3.azl3.aarch64.rpm
239+
libtasn1-devel-4.19.0-3.azl3.aarch64.rpm
240240
libtool-2.4.7-1.azl3.aarch64.rpm
241241
libtool-debuginfo-2.4.7-1.azl3.aarch64.rpm
242242
libxcrypt-4.4.36-2.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -242,9 +242,9 @@ libssh2-debuginfo-1.11.1-1.azl3.x86_64.rpm
242242
libssh2-devel-1.11.1-1.azl3.x86_64.rpm
243243
libstdc++-13.2.0-7.azl3.x86_64.rpm
244244
libstdc++-devel-13.2.0-7.azl3.x86_64.rpm
245-
libtasn1-4.19.0-2.azl3.x86_64.rpm
246-
libtasn1-debuginfo-4.19.0-2.azl3.x86_64.rpm
247-
libtasn1-devel-4.19.0-2.azl3.x86_64.rpm
245+
libtasn1-4.19.0-3.azl3.x86_64.rpm
246+
libtasn1-debuginfo-4.19.0-3.azl3.x86_64.rpm
247+
libtasn1-devel-4.19.0-3.azl3.x86_64.rpm
248248
libtool-2.4.7-1.azl3.x86_64.rpm
249249
libtool-debuginfo-2.4.7-1.azl3.x86_64.rpm
250250
libxml2-2.11.5-8.azl3.x86_64.rpm

0 commit comments

Comments
 (0)