CVE-2014-3469

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-06-05 · updated 2026-06-17
Weakness: CWE-476

Description

The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument.

Affected products

Debian Linux: 7.0
[UNKNOWN] gnutls: before 3.5.7 — fixed in 3.5.7
GnuTLS libtasn1: before 3.6 — fixed in 3.6
RedHat Enterprise Linux Desktop: 5.0, 6.0, 7.0
RedHat Enterprise Linux Eus: 6.5, 7.3, 7.4, 7.5, 7.6, 7.7
RedHat Enterprise Linux Server: 5.0, 6.0, 7.0
RedHat Enterprise Linux Server Aus: 6.5, 7.3, 7.4, 7.6, 7.7
RedHat Enterprise Linux Server Tus: 6.5, 7.3, 7.6, 7.7
RedHat Enterprise Linux Workstation: 5.0, 6.0, 7.0
RedHat Virtualization: 6.0
SUSE Linux Enterprise Server 15 SP1: 11-sp3
SUSE Linux Enterprise High Availability Extension: 11-sp3
SUSE Linux Enterprise Server: 11-sp1, 11-sp2, 11-sp3
SUSE Linux Enterprise Software Development Kit: 11-sp3

How to fix

Upgrade to a fixed version: [UNKNOWN] gnutls 3.5.7; GnuTLS libtasn1 3.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2014-3469 or the next vulnerability affects your stack