Amazon Linux 2 Security Advisory: ALAS2-2025-2886
Advisory Released Date: 2025-06-12
Advisory Updated Date: 2025-06-12
Severity:
Medium
Issue Overview:
When an input DER data contains a large number of SEQUENCE OF or SET OF elements, decoding the data and searching a specific element in it take quadratic time to complete. This could be utilized for a remote DoS attack by presenting a crafted certificate to the network peer. (CVE-2024-12133)
Affected Packages:
libtasn1
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update libtasn1 to update your system.
New Packages:
aarch64:
libtasn1-4.10-1.amzn2.0.7.aarch64
libtasn1-devel-4.10-1.amzn2.0.7.aarch64
libtasn1-tools-4.10-1.amzn2.0.7.aarch64
libtasn1-debuginfo-4.10-1.amzn2.0.7.aarch64
i686:
libtasn1-4.10-1.amzn2.0.7.i686
libtasn1-devel-4.10-1.amzn2.0.7.i686
libtasn1-tools-4.10-1.amzn2.0.7.i686
libtasn1-debuginfo-4.10-1.amzn2.0.7.i686
src:
libtasn1-4.10-1.amzn2.0.7.src
x86_64:
libtasn1-4.10-1.amzn2.0.7.x86_64
libtasn1-devel-4.10-1.amzn2.0.7.x86_64
libtasn1-tools-4.10-1.amzn2.0.7.x86_64
libtasn1-debuginfo-4.10-1.amzn2.0.7.x86_64