REDHAT-BUG-2500380: High severity pypi/pyasn1 vulnerability
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pyasn1to a version that resolves this vulnerability.Fixed in 0.6.4
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2500380?
The severity of REDHAT-BUG-2500380 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2500380?
To fix REDHAT-BUG-2500380, upgrade pyasn1 to version 0.6.4 or later.
What is the main issue with REDHAT-BUG-2500380?
REDHAT-BUG-2500380 describes a performance issue where the DECODERS process certain values in quadratic time, leading to excessive CPU consumption.
Which software is affected by REDHAT-BUG-2500380?
The affected software for REDHAT-BUG-2500380 is the pyasn1 library found on PyPI.
What type of vulnerability is identified in REDHAT-BUG-2500380?
REDHAT-BUG-2500380 identifies a denial of service vulnerability due to inefficient processing of certain data types.