OESA-2021-1029

Dashboard / Vulnerabilities / OESA-2021-1029

OESA-2021-1029

Summary: libtomcrypt security update

Details: LibTomCrypt is a fairly comprehensive, modular and portable cryptographic toolkit that provides developers with a vast array of well known published block ciphers, one-way hash functions, chaining modes, pseudo-random number generators, public key cryptography and a plethora of other routines. \r\n\r\n Security Fix(es):\r\n\r\n In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.(CVE-2019-17362)\r\n\r\n

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1029, https://nvd.nist.gov/vuln/detail/CVE-2019-17362