{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-59886: fix DoS via crafted ASN.1 REAL values with large exponents", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793081830", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793081830" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux7els/advisories/2026/clsa-2026_1793081830.json" } ], "tracking": { "current_release_date": "2026-10-27T06:17:56Z", "generator": { "date": "2026-10-27T06:17:56Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1793081830", "initial_release_date": "2026-10-27T06:17:56Z", "revision_history": [ { "date": "2026-10-27T06:17:56Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "python-pyasn1: Fix of 2 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 7", "product": { "name": "Oracle Linux 7", "product_id": "Oracle-Linux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "python2-pyasn1-modules-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "product": { "name": "python2-pyasn1-modules-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "product_id": "python2-pyasn1-modules-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/python2-pyasn1-modules@0.1.9-7.0.1.el7.tuxcare.els1?arch=noarch" } } }, { "category": "product_version", "name": "python2-pyasn1-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "product": { "name": "python2-pyasn1-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "product_id": "python2-pyasn1-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/python2-pyasn1@0.1.9-7.0.1.el7.tuxcare.els1?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "python2-pyasn1-modules-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:python2-pyasn1-modules-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch" }, "product_reference": "python2-pyasn1-modules-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "python2-pyasn1-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:python2-pyasn1-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch" }, "product_reference": "python2-pyasn1-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "relates_to_product_reference": "Oracle-Linux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-23490", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:python2-pyasn1-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "Oracle-Linux-7:python2-pyasn1-modules-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23490" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970", "url": "https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2", "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq", "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13508", "url": "https://access.redhat.com/errata/RHSA-2026:13508" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13512", "url": "https://access.redhat.com/errata/RHSA-2026:13512" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13545", "url": "https://access.redhat.com/errata/RHSA-2026:13545" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13553", "url": "https://access.redhat.com/errata/RHSA-2026:13553" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:14020", "url": "https://access.redhat.com/errata/RHSA-2026:14020" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:17446", "url": "https://access.redhat.com/errata/RHSA-2026:17446" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:17595", "url": "https://access.redhat.com/errata/RHSA-2026:17595" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:17611", "url": "https://access.redhat.com/errata/RHSA-2026:17611" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:1903", "url": "https://access.redhat.com/errata/RHSA-2026:1903" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:1904", "url": "https://access.redhat.com/errata/RHSA-2026:1904" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:1905", "url": "https://access.redhat.com/errata/RHSA-2026:1905" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:1906", "url": "https://access.redhat.com/errata/RHSA-2026:1906" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19712", "url": "https://access.redhat.com/errata/RHSA-2026:19712" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2221", "url": "https://access.redhat.com/errata/RHSA-2026:2221" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2299", "url": "https://access.redhat.com/errata/RHSA-2026:2299" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2300", "url": "https://access.redhat.com/errata/RHSA-2026:2300" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2302", "url": "https://access.redhat.com/errata/RHSA-2026:2302" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2303", "url": "https://access.redhat.com/errata/RHSA-2026:2303" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2309", "url": "https://access.redhat.com/errata/RHSA-2026:2309" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:24476", "url": "https://access.redhat.com/errata/RHSA-2026:24476" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:24483", "url": "https://access.redhat.com/errata/RHSA-2026:24483" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2453", "url": "https://access.redhat.com/errata/RHSA-2026:2453" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2460", "url": "https://access.redhat.com/errata/RHSA-2026:2460" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2483", "url": "https://access.redhat.com/errata/RHSA-2026:2483" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2486", "url": "https://access.redhat.com/errata/RHSA-2026:2486" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:24866", "url": "https://access.redhat.com/errata/RHSA-2026:24866" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:24977", "url": "https://access.redhat.com/errata/RHSA-2026:24977" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2712", "url": "https://access.redhat.com/errata/RHSA-2026:2712" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:2758", "url": "https://access.redhat.com/errata/RHSA-2026:2758" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:28042", "url": "https://access.redhat.com/errata/RHSA-2026:28042" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30088", "url": "https://access.redhat.com/errata/RHSA-2026:30088" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3354", "url": "https://access.redhat.com/errata/RHSA-2026:3354" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3359", "url": "https://access.redhat.com/errata/RHSA-2026:3359" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:37275", "url": "https://access.redhat.com/errata/RHSA-2026:37275" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3958", "url": "https://access.redhat.com/errata/RHSA-2026:3958" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3959", "url": "https://access.redhat.com/errata/RHSA-2026:3959" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:39894", "url": "https://access.redhat.com/errata/RHSA-2026:39894" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4138", "url": "https://access.redhat.com/errata/RHSA-2026:4138" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4139", "url": "https://access.redhat.com/errata/RHSA-2026:4139" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4140", "url": "https://access.redhat.com/errata/RHSA-2026:4140" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4141", "url": "https://access.redhat.com/errata/RHSA-2026:4141" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4142", "url": "https://access.redhat.com/errata/RHSA-2026:4142" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4143", "url": "https://access.redhat.com/errata/RHSA-2026:4143" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4144", "url": "https://access.redhat.com/errata/RHSA-2026:4144" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4145", "url": "https://access.redhat.com/errata/RHSA-2026:4145" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4146", "url": "https://access.redhat.com/errata/RHSA-2026:4146" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4147", "url": "https://access.redhat.com/errata/RHSA-2026:4147" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4148", "url": "https://access.redhat.com/errata/RHSA-2026:4148" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:41928", "url": "https://access.redhat.com/errata/RHSA-2026:41928" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:42644", "url": "https://access.redhat.com/errata/RHSA-2026:42644" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4943", "url": "https://access.redhat.com/errata/RHSA-2026:4943" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:54757", "url": "https://access.redhat.com/errata/RHSA-2026:54757" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:5606", "url": "https://access.redhat.com/errata/RHSA-2026:5606" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-23490", "url": "https://access.redhat.com/security/cve/CVE-2026-23490" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2430472", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430472" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23490.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23490.json" } ], "release_date": "2026-01-16T19:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:17:11.764380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793081830", "product_ids": [ "Oracle-Linux-7:python2-pyasn1-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "Oracle-Linux-7:python2-pyasn1-modules-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793081830" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-59886", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:python2-pyasn1-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "Oracle-Linux-7:python2-pyasn1-modules-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-59886" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886", "url": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4", "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r", "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r" } ], "release_date": "2026-07-14T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:17:11.764380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793081830", "product_ids": [ "Oracle-Linux-7:python2-pyasn1-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch", "Oracle-Linux-7:python2-pyasn1-modules-0:0.1.9-7.0.1.el7.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793081830" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }