CVE:CVE-2016-4008
CNNVD:CNNVD-201604-303
GnuTLS是比利时Nikos Mavrogiannopoulos和瑞典Simon Josefsson软件开发者共同研发的一个免费的用于实现SSL、TLS和DTLS协议的安全通信库。GnuTLS libtasn1是软件开发者Fabio Fiorina所研发的一个用于GnuTLS中的ASN.1结构管理库。
GNU Libtasn1 4.8之前版本的lib/decoding.c文件中的‘_asn1_extract_der_octet’函数存在安全漏洞。当程序没有ASN1_DECODE_FLAG_STRICT_DER标志时，远程攻击者可借助特制的证书利用该漏洞造成拒绝服务（无限递归）。
solution:Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,15.10,16.04,and avoid the version 12.04,14.04,15.10,16.04; Upgrade opensuse opensuse to a higher version than 13.2,and avoid the version 13.2; Upgrade gnu libtasn1 to a higher version than 4.7,and avoid the version (,4.7]; Upgrade fedoraproject fedora to a higher version than 22,23,24,and avoid the version 22,23,24