CyberRota Analysis
AI-GeneratedThe pyasn1 library for Python is vulnerable to a denial-of-service attack due to inefficient processing of OBJECT IDENTIFIER and RELATIVE-OID values, where crafted payloads can lead to excessive CPU consumption during decoding. This vulnerability can severely impact applications that decode untrusted ASN.1 data, making it critical for developers and organizations using affected versions prior to 0.6.4 to prioritize upgrading to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
Related CVEs
Other vulnerabilities affecting the same vendor(s)