CyberRota Analysis
AI-GeneratedThe pyasn1 library for Python, prior to version 0.6.4, is vulnerable to a denial-of-service attack due to its BER decoder's inability to limit the size of long-form tags, which can lead to excessive CPU consumption and unhandled exceptions in Python 3.11 and later. Applications that decode untrusted BER, CER, or DER inputs should prioritize upgrading to version 0.6.4 to mitigate this high-severity vulnerability. Organizations relying on pyasn1 for processing ASN.1 data should assess their exposure and implement the necessary updates promptly.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
Related CVEs
Other vulnerabilities affecting the same vendor(s)