Bug 2430472 (CVE-2026-23490)
| Summary: | CVE-2026-23490 pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aadhikar, alcohan, alinfoot, amctagga, anpicker, anthomas, aoconnor, aprice, bbrownin, bdettelb, bniver, bparees, brasmith, bsmejkal, carogers, caswilli, cmyers, cochase, crizzo, dfreiber, dnakabaa, doconnor, dranck, drow, dschmidt, dtrifiro, dymurray, eborisov, ebourniv, eglynn, ehelms, erezende, flucifre, ggainey, gmeno, gparvin, groman, gtanzill, haoli, hasun, hkataria, ibolton, jachapma, jajackso, jbalunas, jburrell, jbuscemi, jcammara, jdobes, jfula, jjoyce, jkoehler, jlanda, jmatthew, jmitchel, jmontleo, jneedle, joehler, jowilson, jpretori, jsamir, jschluet, juwatts, jwong, kaycoth, kbempah, kegrant, kgaikwad, koliveir, kshier, lball, lcouzens, lgallett, lhh, ljawale, lphiri, luizcosta, mabashia, manissin, mattdavi, mbenjamin, mburns, mgarciac, mhackett, mhayden, mhulan, mreynolds, mrunge, mskarbek, ngough, nmoumoul, nweather, nyancey, oezr, omaciel, ometelka, orabin, osousa, owatkins, pahickey, pakotvan, pbohmill, pbraun, pcreech, pgaikwad, prodsec-dev, progier, ptisnovs, rbobbitt, rbryant, rchan, rhaigner, rhel-process-autobot, rjohnson, sbunciak, sdoran, shvarugh, simaishi, slucidi, smallamp, smcdonal, snegrini, solenoci, sostapov, spichugi, sseago, ssidhaye, stcannon, sthirugn, syedriko, tbordaz, teagle, tfister, thavo, tmalecek, ttakamiy, vashirov, vereddy, veshanka, vimartin, vkumar, watson-tool-maintainers, weaton, xdharmai, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | Flags: | spichugi:
needinfo?
(prodsec-dev) |
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in pyasn1, a generic ASN.1 library for Python. A remote attacker could exploit this vulnerability by sending a specially crafted RELATIVE-OID with excessive continuation octets. This input validation vulnerability leads to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2460558, 2460559, 2460560, 2438395, 2438396 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-01-16 20:03:58 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:1904 https://access.redhat.com/errata/RHSA-2026:1904 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:1905 https://access.redhat.com/errata/RHSA-2026:1905 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:1906 https://access.redhat.com/errata/RHSA-2026:1906 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:1903 https://access.redhat.com/errata/RHSA-2026:1903 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:2221 https://access.redhat.com/errata/RHSA-2026:2221 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2026:2303 https://access.redhat.com/errata/RHSA-2026:2303 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:2300 https://access.redhat.com/errata/RHSA-2026:2300 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:2302 https://access.redhat.com/errata/RHSA-2026:2302 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:2299 https://access.redhat.com/errata/RHSA-2026:2299 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:2309 https://access.redhat.com/errata/RHSA-2026:2309 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2026:2453 https://access.redhat.com/errata/RHSA-2026:2453 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:2460 https://access.redhat.com/errata/RHSA-2026:2460 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:2483 https://access.redhat.com/errata/RHSA-2026:2483 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2026:2486 https://access.redhat.com/errata/RHSA-2026:2486 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:2712 https://access.redhat.com/errata/RHSA-2026:2712 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:2758 https://access.redhat.com/errata/RHSA-2026:2758 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:3354 https://access.redhat.com/errata/RHSA-2026:3354 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:3359 https://access.redhat.com/errata/RHSA-2026:3359 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.6 for RHEL 9 Red Hat Ansible Automation Platform 2.6 for RHEL 10 Via RHSA-2026:3958 https://access.redhat.com/errata/RHSA-2026:3958 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Via RHSA-2026:3959 https://access.redhat.com/errata/RHSA-2026:3959 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2026:4145 https://access.redhat.com/errata/RHSA-2026:4145 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:4142 https://access.redhat.com/errata/RHSA-2026:4142 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:4138 https://access.redhat.com/errata/RHSA-2026:4138 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2026:4144 https://access.redhat.com/errata/RHSA-2026:4144 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:4148 https://access.redhat.com/errata/RHSA-2026:4148 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:4146 https://access.redhat.com/errata/RHSA-2026:4146 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2026:4140 https://access.redhat.com/errata/RHSA-2026:4140 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:4139 https://access.redhat.com/errata/RHSA-2026:4139 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:4147 https://access.redhat.com/errata/RHSA-2026:4147 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:4143 https://access.redhat.com/errata/RHSA-2026:4143 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:4141 https://access.redhat.com/errata/RHSA-2026:4141 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.6 for RHEL 10 Red Hat Ansible Automation Platform 2.6 for RHEL 9 Via RHSA-2026:13508 https://access.redhat.com/errata/RHSA-2026:13508 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Via RHSA-2026:13512 https://access.redhat.com/errata/RHSA-2026:13512 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2026:17446 https://access.redhat.com/errata/RHSA-2026:17446 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2026:17595 https://access.redhat.com/errata/RHSA-2026:17595 |