CVE-2012-1569

Exp

The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.

Published: 2012-03-26 Last update: 2026-04-29 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2012-1569 is rated High Exploit Risk (67.6/100): CVSS Medium severity, with high exploitation likelihood (EPSS 10.12%, 93th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2012-1569

EDB-ID Source Kind Published Link
nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2012-1569

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-07 10.17% 10.12% -0.05%
2 2026-01-09 12.72% 10.17% -2.56%
3 2025-09-25 12.72%

Full EPSS history (17 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2012-1569

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.0 2.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:P)
Partial availability impact.
10.0 2.9 [email protected]

Weakness enumeration for CVE-2012-1569

OS Trackers for CVE-2012-1569

vendor priority summary link
gentoo normal CVE-2012-1569: 1 GLSA(s) (201209-12), 1 atom(s) (dev-libs/libtasn1); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2012-1569
redhat high https://access.redhat.com/security/cve/CVE-2012-1569
suse medium CVE-2012-1569 severity moderate: SUSE including 74 source package names (gnutls-2.4.1-24.39.45.1, gnutls-2.4.1-24.39.55.1, …), 117 product×package rows across 30 product lines (SUSE Linux Enterprise Desktop 12, SUSE Linux Enterprise Desktop 12 SP1, … (30 product lines)): Fixed 117. https://www.suse.com/security/cve/CVE-2012-1569/
ubuntu medium CVE-2012-1569 medium priority: Ubuntu including 1 source packages (libtasn1-3), 7 status rows across 7 suites (hardy, lucid, maverick, natty, oneiric, precise, upstream): released 6, ignored 1. https://ubuntu.com/security/CVE-2012-1569

Affected software / configurations for CVE-2012-1569

Vendor Product Version Raw CPE
gnu gnutls <= 3.0.15 cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*
gnu gnutls 1.0.16 cpe:2.3:a:gnu:gnutls:1.0.16:*:*:*:*:*:*:*
gnu gnutls 1.0.17 cpe:2.3:a:gnu:gnutls:1.0.17:*:*:*:*:*:*:*
gnu gnutls 1.0.18 cpe:2.3:a:gnu:gnutls:1.0.18:*:*:*:*:*:*:*
gnu gnutls 1.0.19 cpe:2.3:a:gnu:gnutls:1.0.19:*:*:*:*:*:*:*
gnu gnutls 1.0.20 cpe:2.3:a:gnu:gnutls:1.0.20:*:*:*:*:*:*:*
gnu gnutls 1.0.21 cpe:2.3:a:gnu:gnutls:1.0.21:*:*:*:*:*:*:*
gnu gnutls 1.0.22 cpe:2.3:a:gnu:gnutls:1.0.22:*:*:*:*:*:*:*
gnu gnutls 1.0.23 cpe:2.3:a:gnu:gnutls:1.0.23:*:*:*:*:*:*:*
gnu gnutls 1.0.24 cpe:2.3:a:gnu:gnutls:1.0.24:*:*:*:*:*:*:*
gnu gnutls 1.0.25 cpe:2.3:a:gnu:gnutls:1.0.25:*:*:*:*:*:*:*
gnu gnutls 1.1.13 cpe:2.3:a:gnu:gnutls:1.1.13:*:*:*:*:*:*:*
gnu gnutls 1.1.14 cpe:2.3:a:gnu:gnutls:1.1.14:*:*:*:*:*:*:*
gnu gnutls 1.1.15 cpe:2.3:a:gnu:gnutls:1.1.15:*:*:*:*:*:*:*
gnu gnutls 1.1.16 cpe:2.3:a:gnu:gnutls:1.1.16:*:*:*:*:*:*:*
gnu gnutls 1.1.17 cpe:2.3:a:gnu:gnutls:1.1.17:*:*:*:*:*:*:*
gnu gnutls 1.1.18 cpe:2.3:a:gnu:gnutls:1.1.18:*:*:*:*:*:*:*
gnu gnutls 1.1.19 cpe:2.3:a:gnu:gnutls:1.1.19:*:*:*:*:*:*:*
gnu gnutls 1.1.20 cpe:2.3:a:gnu:gnutls:1.1.20:*:*:*:*:*:*:*
gnu gnutls 1.1.21 cpe:2.3:a:gnu:gnutls:1.1.21:*:*:*:*:*:*:*
gnu gnutls 1.1.22 cpe:2.3:a:gnu:gnutls:1.1.22:*:*:*:*:*:*:*
gnu gnutls 1.1.23 cpe:2.3:a:gnu:gnutls:1.1.23:*:*:*:*:*:*:*
gnu gnutls 1.2.0 cpe:2.3:a:gnu:gnutls:1.2.0:*:*:*:*:*:*:*
gnu gnutls 1.2.1 cpe:2.3:a:gnu:gnutls:1.2.1:*:*:*:*:*:*:*
gnu gnutls 1.2.2 cpe:2.3:a:gnu:gnutls:1.2.2:*:*:*:*:*:*:*
gnu gnutls 1.2.3 cpe:2.3:a:gnu:gnutls:1.2.3:*:*:*:*:*:*:*
gnu gnutls 1.2.4 cpe:2.3:a:gnu:gnutls:1.2.4:*:*:*:*:*:*:*
gnu gnutls 1.2.5 cpe:2.3:a:gnu:gnutls:1.2.5:*:*:*:*:*:*:*
gnu gnutls 1.2.6 cpe:2.3:a:gnu:gnutls:1.2.6:*:*:*:*:*:*:*
gnu gnutls 1.2.7 cpe:2.3:a:gnu:gnutls:1.2.7:*:*:*:*:*:*:*
gnu gnutls 1.2.8 cpe:2.3:a:gnu:gnutls:1.2.8:*:*:*:*:*:*:*
gnu gnutls 1.2.8.1a1 cpe:2.3:a:gnu:gnutls:1.2.8.1a1:*:*:*:*:*:*:*
gnu gnutls 1.2.9 cpe:2.3:a:gnu:gnutls:1.2.9:*:*:*:*:*:*:*
gnu gnutls 1.2.10 cpe:2.3:a:gnu:gnutls:1.2.10:*:*:*:*:*:*:*
gnu gnutls 1.2.11 cpe:2.3:a:gnu:gnutls:1.2.11:*:*:*:*:*:*:*
gnu gnutls 1.3.0 cpe:2.3:a:gnu:gnutls:1.3.0:*:*:*:*:*:*:*
gnu gnutls 1.3.1 cpe:2.3:a:gnu:gnutls:1.3.1:*:*:*:*:*:*:*
gnu gnutls 1.3.2 cpe:2.3:a:gnu:gnutls:1.3.2:*:*:*:*:*:*:*
gnu gnutls 1.3.3 cpe:2.3:a:gnu:gnutls:1.3.3:*:*:*:*:*:*:*
gnu gnutls 1.3.4 cpe:2.3:a:gnu:gnutls:1.3.4:*:*:*:*:*:*:*
gnu gnutls 1.3.5 cpe:2.3:a:gnu:gnutls:1.3.5:*:*:*:*:*:*:*
gnu gnutls 1.4.0 cpe:2.3:a:gnu:gnutls:1.4.0:*:*:*:*:*:*:*
gnu gnutls 1.4.1 cpe:2.3:a:gnu:gnutls:1.4.1:*:*:*:*:*:*:*
gnu gnutls 1.4.2 cpe:2.3:a:gnu:gnutls:1.4.2:*:*:*:*:*:*:*
gnu gnutls 1.4.3 cpe:2.3:a:gnu:gnutls:1.4.3:*:*:*:*:*:*:*
gnu gnutls 1.4.4 cpe:2.3:a:gnu:gnutls:1.4.4:*:*:*:*:*:*:*
gnu gnutls 1.4.5 cpe:2.3:a:gnu:gnutls:1.4.5:*:*:*:*:*:*:*
gnu gnutls 1.5.0 cpe:2.3:a:gnu:gnutls:1.5.0:*:*:*:*:*:*:*
gnu gnutls 1.5.1 cpe:2.3:a:gnu:gnutls:1.5.1:*:*:*:*:*:*:*
gnu gnutls 1.5.2 cpe:2.3:a:gnu:gnutls:1.5.2:*:*:*:*:*:*:*
gnu gnutls 1.5.3 cpe:2.3:a:gnu:gnutls:1.5.3:*:*:*:*:*:*:*
gnu gnutls 1.5.4 cpe:2.3:a:gnu:gnutls:1.5.4:*:*:*:*:*:*:*
gnu gnutls 1.5.5 cpe:2.3:a:gnu:gnutls:1.5.5:*:*:*:*:*:*:*
gnu gnutls 1.6.0 cpe:2.3:a:gnu:gnutls:1.6.0:*:*:*:*:*:*:*
gnu gnutls 1.6.1 cpe:2.3:a:gnu:gnutls:1.6.1:*:*:*:*:*:*:*
gnu gnutls 1.6.2 cpe:2.3:a:gnu:gnutls:1.6.2:*:*:*:*:*:*:*
gnu gnutls 1.6.3 cpe:2.3:a:gnu:gnutls:1.6.3:*:*:*:*:*:*:*
gnu gnutls 1.7.0 cpe:2.3:a:gnu:gnutls:1.7.0:*:*:*:*:*:*:*
gnu gnutls 1.7.1 cpe:2.3:a:gnu:gnutls:1.7.1:*:*:*:*:*:*:*
gnu gnutls 1.7.2 cpe:2.3:a:gnu:gnutls:1.7.2:*:*:*:*:*:*:*
gnu gnutls 1.7.3 cpe:2.3:a:gnu:gnutls:1.7.3:*:*:*:*:*:*:*
gnu gnutls 1.7.4 cpe:2.3:a:gnu:gnutls:1.7.4:*:*:*:*:*:*:*
gnu gnutls 1.7.5 cpe:2.3:a:gnu:gnutls:1.7.5:*:*:*:*:*:*:*
gnu gnutls 1.7.6 cpe:2.3:a:gnu:gnutls:1.7.6:*:*:*:*:*:*:*
gnu gnutls 1.7.7 cpe:2.3:a:gnu:gnutls:1.7.7:*:*:*:*:*:*:*
gnu gnutls 1.7.8 cpe:2.3:a:gnu:gnutls:1.7.8:*:*:*:*:*:*:*
gnu gnutls 1.7.9 cpe:2.3:a:gnu:gnutls:1.7.9:*:*:*:*:*:*:*
gnu gnutls 1.7.10 cpe:2.3:a:gnu:gnutls:1.7.10:*:*:*:*:*:*:*
gnu gnutls 1.7.11 cpe:2.3:a:gnu:gnutls:1.7.11:*:*:*:*:*:*:*
gnu gnutls 1.7.12 cpe:2.3:a:gnu:gnutls:1.7.12:*:*:*:*:*:*:*
gnu gnutls 1.7.13 cpe:2.3:a:gnu:gnutls:1.7.13:*:*:*:*:*:*:*
gnu gnutls 1.7.14 cpe:2.3:a:gnu:gnutls:1.7.14:*:*:*:*:*:*:*
gnu gnutls 1.7.15 cpe:2.3:a:gnu:gnutls:1.7.15:*:*:*:*:*:*:*
gnu gnutls 1.7.16 cpe:2.3:a:gnu:gnutls:1.7.16:*:*:*:*:*:*:*
gnu gnutls 1.7.17 cpe:2.3:a:gnu:gnutls:1.7.17:*:*:*:*:*:*:*
gnu gnutls 1.7.18 cpe:2.3:a:gnu:gnutls:1.7.18:*:*:*:*:*:*:*
gnu gnutls 1.7.19 cpe:2.3:a:gnu:gnutls:1.7.19:*:*:*:*:*:*:*
gnu gnutls 2.0.0 cpe:2.3:a:gnu:gnutls:2.0.0:*:*:*:*:*:*:*
gnu gnutls 2.0.1 cpe:2.3:a:gnu:gnutls:2.0.1:*:*:*:*:*:*:*
gnu gnutls 2.0.2 cpe:2.3:a:gnu:gnutls:2.0.2:*:*:*:*:*:*:*

References for CVE-2012-1569

URL Tags
http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5932 Patch
http://article.gmane.org/gmane.comp.gnu.libtasn1.general/53
http://article.gmane.org/gmane.comp.gnu.libtasn1.general/54
http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/ Exploit
http://linux.oracle.com/errata/ELSA-2014-0596.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/076856.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/076865.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077284.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077339.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078207.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076699.html
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
http://rhn.redhat.com/errata/RHSA-2012-0427.html
http://rhn.redhat.com/errata/RHSA-2012-0488.html
http://rhn.redhat.com/errata/RHSA-2012-0531.html
http://secunia.com/advisories/48397
http://secunia.com/advisories/48488
http://secunia.com/advisories/48505
http://secunia.com/advisories/48578
http://secunia.com/advisories/48596
http://secunia.com/advisories/49002
http://secunia.com/advisories/50739
http://secunia.com/advisories/57260
http://www.debian.org/security/2012/dsa-2440
http://www.gnu.org/software/gnutls/security.html Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2012:039
http://www.openwall.com/lists/oss-security/2012/03/20/3
http://www.openwall.com/lists/oss-security/2012/03/20/8
http://www.openwall.com/lists/oss-security/2012/03/21/5
http://www.securitytracker.com/id?1026829
http://www.ubuntu.com/usn/USN-1436-1
https://bugzilla.redhat.com/show_bug.cgi?id=804920
cvelogic Threat Intelligence