CVE-2013-7488 Denial of service in n/a
Remote attackers can cause an infinite loop in the Perl Convert::ASN1 module via unexpected input, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-7488?
CVE-2013-7488 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 7 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected input.
Weakness: CWE-835
Which versions are affected by CVE-2013-7488?
It affects 2 products.
Linux distribution packages (8)
perl-Convert-ASN1 AlmaLinux:8 | All versions | 0.27-18.el8 |
perl-Convert-ASN1 Red Hat:enterprise_linux:8::appstream | All versions | 0:0.27-18.el8 |
perl-Convert-ASN1 Rocky Linux:8 | All versions | 0:0.27-18.el8 |
perl-Convert-ASN1 SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 0.27-1.6.2 |
perl-Convert-ASN1 SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 0.27-1.6.2 |
perl-Convert-ASN1 SUSE:Linux Enterprise Server 12 SP5 | All versions | 0.26-5.3.1 |
perl-Convert-ASN1 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 0.26-5.3.1 |
perl-Convert-ASN1 openSUSE:Tumbleweed | All versions | 0.31-2.3 |
Products include Convert\ \, Fedoraproject Fedora.
How do I fix CVE-2013-7488?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2013-7488 being exploited?
There is no known exploitation of CVE-2013-7488 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2013-7488, ALSA-2024:3049, DEBIAN-CVE-2013-7488, GHSA-8wqq-xrhr-w6mf, MGASA-2021-0363, RHSA-2024:3049 and 5 more.