REDHAT-BUG-2500041: High severity pypi/pyasn1 vulnerability
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pyasn1to a version that resolves this vulnerability.Fixed in 0.6.4
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2500041?
The severity of REDHAT-BUG-2500041 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2500041?
To fix REDHAT-BUG-2500041, you should upgrade the pyasn1 library to version 0.6.4 or later.
What are the risks associated with REDHAT-BUG-2500041?
The risks associated with REDHAT-BUG-2500041 include potential security vulnerabilities related to the conversion of ASN.1 REAL values to Python floats.
Which software is affected by REDHAT-BUG-2500041?
The software affected by REDHAT-BUG-2500041 is the pyasn1 library in Python.
When was REDHAT-BUG-2500041 published?
REDHAT-BUG-2500041 was published on July 14, 2026.