CVE-2016-4008

What it actually does

The _asn1_extract_der_octet function in libtasn1 before 4.8 performs unbounded recursion when processing certain DER structures in certificates if ASN1_DECODE_FLAG_STRICT_DER is not set, leading to stack exhaustion and denial of service.

Why it matters to the business

Applications or services that parse untrusted certificates using the vulnerable library version can experience sudden unavailability or high resource consumption, disrupting dependent workloads and requiring emergency restarts or rollbacks.

How an attack unfolds

An attacker crafts a certificate containing a deeply nested or malformed DER octet string and delivers it to any network-facing component that invokes libtasn1 decoding without the strict flag; the parser enters infinite recursion and the process terminates or hangs.

How to fix it

Upgrade GNU Libtasn1 to version 4.8 or later. For the affected Chainguard package newrelic-nri-kube-events-1.9, update to 1.9.3-r2 or newer which bundles the corrected library.

How to confirm the fix worked

Confirm the installed libtasn1 shared library or package reports version 4.8 or greater; recompile or redeploy the application with ASN1_DECODE_FLAG_STRICT_DER enabled where possible and test against known recursive test vectors.

Typical attack path

1. Locate a service or library call path that decodes certificates with GNU Libtasn1 < 4.8
2. Generate a minimal DER certificate that triggers recursive descent in _asn1_extract_der_octet
3. Transmit the certificate over the network or supply it through a local API
4. Observe process crash, high CPU, or memory exhaustion confirming successful denial of service

How to detect it

Search process crash dumps, high-CPU threads, or repeated stack traces containing _asn1_extract_der_octet; review TLS handshake or certificate ingestion logs for sudden terminations around the time of external certificate submissions.

What your security team should do

• Immediately upgrade the listed Chainguard package to the fixed release 1.9.3-r2
• Audit all other products or containers for bundled copies of libtasn1 older than 4.8
• Enable strict DER decoding flags in all certificate-parsing code paths
• Monitor EPSS trend and reassess exploit maturity as new tooling appears