{ "threat_severity" : "Important", "public_date" : "2026-07-14T16:40:00Z", "bugzilla" : { "description" : "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER", "id" : "2500380", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2500380" }, "cvss3" : { "cvss3_base_score" : "7.5", "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status" : "verified" }, "cwe" : "CWE-1050", "details" : [ "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.", "A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One (ASN.1). The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload containing an OID with many arcs, leading to excessive CPU consumption and a denial of service (DoS) in applications that decode untrusted ASN.1 data. The corresponding encoders also exhibit this quadratic behavior when re-encoding attacker-supplied values." ], "statement" : "A flaw was found in pyasn1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call, allowing denial of service in applications that decode untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos). The corresponding encoders exhibit the same behavior when re-encoding attacker-supplied values. The arc-size limit introduced for CVE-2026-23490 does not mitigate this issue. This issue is fixed in pyasn1 version 0.6.4.", "affected_release" : [ { "product_name" : "Red Hat Ansible Automation Platform 2.5 for RHEL 8", "release_date" : "2026-08-04T00:00:00Z", "advisory" : "RHSA-2026:50319", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.5::el8", "package" : "python3.12-pyasn1-0:0.6.4-1.el8ap" }, { "product_name" : "Red Hat Ansible Automation Platform 2.5 for RHEL 9", "release_date" : "2026-08-04T00:00:00Z", "advisory" : "RHSA-2026:50319", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.5::el9", "package" : "python3.12-pyasn1-0:0.6.4-1.el9ap" }, { "product_name" : "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date" : "2026-08-04T00:00:00Z", "advisory" : "RHSA-2026:50336", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package" : "python3.12-pyasn1-0:0.6.4-1.el9ap" }, { "product_name" : "Red Hat AI Inference Server 3.3", "release_date" : "2026-08-25T00:00:00Z", "advisory" : "RHSA-2026:59518", "cpe" : "cpe:/a:redhat:ai_inference_server:3.3::el9", "package" : "rhaiis/model-opt-cuda-rhel9:1787601159" }, { "product_name" : "Red Hat Enterprise Linux AI 3.3", "release_date" : "2026-09-01T00:00:00Z", "advisory" : "RHSA-2026:62335", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3.3::el9", "package" : "rhelai3/disk-image-cuda-rhel9:1788290314" }, { "product_name" : "Red Hat Enterprise Linux AI 3.3", "release_date" : "2026-09-01T00:00:00Z", "advisory" : "RHSA-2026:62336", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3.3::el9", "package" : "rhelai3/bootc-aws-cuda-rhel9:1788273908" }, { "product_name" : "Red Hat Enterprise Linux AI 3.3", "release_date" : "2026-09-01T00:00:00Z", "advisory" : "RHSA-2026:62336", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3.3::el9", "package" : "rhelai3/bootc-azure-cuda-rhel9:1788273909" }, { "product_name" : "Red Hat Enterprise Linux AI 3.3", "release_date" : "2026-09-01T00:00:00Z", "advisory" : "RHSA-2026:62336", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3.3::el9", "package" : "rhelai3/bootc-cuda-rhel9:1788260684" }, { "product_name" : "Red Hat Enterprise Linux AI 3.3", "release_date" : "2026-09-01T00:00:00Z", "advisory" : "RHSA-2026:62336", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3.3::el9", "package" : "rhelai3/bootc-gcp-cuda-rhel9:1788273977" }, { "product_name" : "Red Hat Hardened Images", "release_date" : "2026-07-15T00:00:00Z", "advisory" : "RHSA-2026:40236", "cpe" : "cpe:/a:redhat:hummingbird:1", "package" : "jaeger-main-2.19.0-1.1.hum1", "impact" : "important" }, { "product_name" : "Red Hat Migration Toolkit for Applications 8.2", "release_date" : "2026-08-18T00:00:00Z", "advisory" : "RHSA-2026:56347", "cpe" : "cpe:/a:redhat:migration_toolkit_applications:8.2::el9", "package" : "mta/mta-rhel9-operator:1786481481" }, { "product_name" : "Red Hat OpenShift AI 2.25", "release_date" : "2026-09-08T00:00:00Z", "advisory" : "RHSA-2026:65126", "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9", "package" : "rhoai/odh-kserve-storage-initializer-rhel9:1787083682" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-kserve-storage-initializer-rhel9:1787073479" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-llama-stack-core-rhel9:1786635926" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-mlflow-rhel9:1787226790" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-model-registry-job-async-upload-rhel9:1787361413" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:1787073866" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1787073873" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9:1787073459" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9:1787073611" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9:1787073451" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9:1787073451" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-th06-cpu-torch210-py312-rhel9:1787076778" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-th06-cuda130-torch210-py312-rhel9:1787077779" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-th06-rocm64-torch291-py312-rhel9:1787076481" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-training-cuda128-torch29-py312-rhel9:1786611803" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1787121387" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:1787074331" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:1787073605" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:1787073546" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:1787073717" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9:1787073713" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-08-27T00:00:00Z", "advisory" : "RHSA-2026:60520", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:1787073593" }, { "product_name" : "Red Hat Quay 3.1", "release_date" : "2026-08-11T00:00:00Z", "advisory" : "RHSA-2026:53520", "cpe" : "cpe:/a:redhat:quay:3.10::el8", "package" : "quay/quay-rhel8:1786395065" }, { "product_name" : "Red Hat Quay 3.12", "release_date" : "2026-08-10T00:00:00Z", "advisory" : "RHSA-2026:52968", "cpe" : "cpe:/a:redhat:quay:3.12::el8", "package" : "quay/quay-rhel8:1786170635" }, { "product_name" : "Red Hat Quay 3.15", "release_date" : "2026-07-30T00:00:00Z", "advisory" : "RHSA-2026:48933", "cpe" : "cpe:/a:redhat:quay:3.15::el8", "package" : "quay/quay-rhel8:1785261506" }, { "product_name" : "Red Hat Quay 3.9", "release_date" : "2026-08-05T00:00:00Z", "advisory" : "RHSA-2026:50931", "cpe" : "cpe:/a:redhat:quay:3.9::el8", "package" : "quay/quay-rhel8:1785950004" } ], "package_state" : [ { "product_name" : "Exploit Intelligence", "fix_state" : "Fix deferred", "package_name" : "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9", "cpe" : "cpe:/a:redhat:exploit_intelligence:0" }, { "product_name" : "Lightspeed Core", "fix_state" : "Fix deferred", "package_name" : "lightspeed-core/lightspeed-stack-rhel9", "cpe" : "cpe:/a:redhat:lightspeed_core" }, { "product_name" : "Migration Toolkit for Applications 8", "fix_state" : "Affected", "package_name" : "mta/mta-solution-server-rhel9", "cpe" : "cpe:/a:redhat:migration_toolkit_applications:8" }, { "product_name" : "Migration Toolkit for Containers", "fix_state" : "Fix deferred", "package_name" : "rhmtc/openshift-migration-rhel8-operator", "cpe" : "cpe:/a:redhat:rhmt:1" }, { "product_name" : "Migration Toolkit for Virtualization", "fix_state" : "Affected", "package_name" : "migration-toolkit-virtualization/mtv-rhel9-operator", "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2" }, { "product_name" : "Migration Toolkit for Virtualization", "fix_state" : "Will not fix", "package_name" : "mtv-candidate/mtv-rhel9-operator", "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2" }, { "product_name" : "OpenShift Lightspeed", "fix_state" : "Affected", "package_name" : "openshift-lightspeed/lightspeed-agentic-sandbox-rhel9", "cpe" : "cpe:/a:redhat:openshift_lightspeed" }, { "product_name" : "OpenShift Lightspeed", "fix_state" : "Affected", "package_name" : "openshift-lightspeed/lightspeed-service-api-rhel9", "cpe" : "cpe:/a:redhat:openshift_lightspeed" }, { "product_name" : "OpenShift Lightspeed", "fix_state" : "Affected", "package_name" : "openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9", "cpe" : "cpe:/a:redhat:openshift_lightspeed" }, { "product_name" : "OpenShift Service Mesh 3", "fix_state" : "Fix deferred", "package_name" : "openshift-service-mesh/kiali-rhel9-operator", "cpe" : "cpe:/a:redhat:service_mesh:3" }, { "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2", "fix_state" : "Not affected", "package_name" : "rhacm2/volsync-operator-bundle", "cpe" : "cpe:/a:redhat:acm:2" }, { "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2", "fix_state" : "Not affected", "package_name" : "rhacm2/volsync-rhel9", "cpe" : "cpe:/a:redhat:acm:2" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Affected", "package_name" : "rhaiis/vllm-rocm-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Will not fix", "package_name" : "rhaiis/vllm-tpu-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Will not fix", "package_name" : "rhaii/vllm-tpu-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-24/ee-minimal-rhel8", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-24/ee-minimal-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-24/ee-supported-rhel8", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-24/ee-supported-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-24/lightspeed-rhel8", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-24/platform-resource-runner-rhel8", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-25/ee-supported-rhel8", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-25/lightspeed-chatbot-rhel8", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-25/lightspeed-rhel8", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/controller-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/controller-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/eda-controller-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/eda-controller-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/ee-supported-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/gateway-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/gateway-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/hub-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/hub-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/lightspeed-chatbot-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/lightspeed-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/lightspeed-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/platform-resource-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/aap-cloud-billing-operator-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/controller-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/controller-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/eda-controller-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/eda-controller-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/ee-supported-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/gateway-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/gateway-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/hub-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/hub-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/lightspeed-chatbot-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/lightspeed-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/lightspeed-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/metrics-service-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-27/platform-resource-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-tech-preview/metrics-service-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ceph Storage 7", "fix_state" : "Fix deferred", "package_name" : "rhceph/rhceph-7-rhel9", "cpe" : "cpe:/a:redhat:ceph_storage:7" }, { "product_name" : "Red Hat Ceph Storage 8", "fix_state" : "Fix deferred", "package_name" : "rhceph/rhceph-8-rhel9", "cpe" : "cpe:/a:redhat:ceph_storage:8" }, { "product_name" : "Red Hat Ceph Storage 9", "fix_state" : "Fix deferred", "package_name" : "rhceph/rhceph-9-rhel9", "cpe" : "cpe:/a:redhat:ceph_storage:9" }, { "product_name" : "Red Hat Enterprise Linux 10", "fix_state" : "Fix deferred", "package_name" : "python-pyasn1", "cpe" : "cpe:/o:redhat:enterprise_linux:10" }, { "product_name" : "Red Hat Enterprise Linux 10", "fix_state" : "Fix deferred", "package_name" : "rhel10/keylime-registrar", "cpe" : "cpe:/o:redhat:enterprise_linux:10" }, { "product_name" : "Red Hat Enterprise Linux 10", "fix_state" : "Fix deferred", "package_name" : "rhel10/keylime-verifier", "cpe" : "cpe:/o:redhat:enterprise_linux:10" }, { "product_name" : "Red Hat Enterprise Linux 6", "fix_state" : "Out of support scope", "package_name" : "python-pyasn1", "cpe" : "cpe:/o:redhat:enterprise_linux:6" }, { "product_name" : "Red Hat Enterprise Linux 7", "fix_state" : "Fix deferred", "package_name" : "python-pyasn1", "cpe" : "cpe:/o:redhat:enterprise_linux:7" }, { "product_name" : "Red Hat Enterprise Linux 7", "fix_state" : "Fix deferred", "package_name" : "resource-agents", "cpe" : "cpe:/o:redhat:enterprise_linux:7" }, { "product_name" : "Red Hat Enterprise Linux 8", "fix_state" : "Fix deferred", "package_name" : "python-pyasn1", "cpe" : "cpe:/o:redhat:enterprise_linux:8" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Fix deferred", "package_name" : "python-pyasn1", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Fix deferred", "package_name" : "rhel9/keylime-registrar", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Fix deferred", "package_name" : "rhel9/keylime-verifier", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-azure-rocm-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-rocm-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Hardened Images", "fix_state" : "Not affected", "package_name" : "llvm", "cpe" : "cpe:/a:redhat:hummingbird:1", "impact" : "important" }, { "product_name" : "Red Hat Hardened Images", "fix_state" : "Not affected", "package_name" : "mariadb11.8", "cpe" : "cpe:/a:redhat:hummingbird:1", "impact" : "important" }, { "product_name" : "Red Hat Hardened Images", "fix_state" : "Not affected", "package_name" : "python-trustme", "cpe" : "cpe:/a:redhat:hummingbird:1", "impact" : "important" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-feature-server-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Not affected", "package_name" : "rhoai/odh-kserve-agent-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Not affected", "package_name" : "rhoai/odh-kserve-controller-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Not affected", "package_name" : "rhoai/odh-kserve-router-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-ml-pipelines-runtime-generic-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-pipelines-components-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Not affected", "package_name" : "rhoai/odh-trustyai-nemo-guardrails-server-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Affected", "package_name" : "openshift4/ose-ansible-rhel9-operator", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Affected", "package_name" : "python-pyasn1", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenStack Platform 16.2", "fix_state" : "Fix deferred", "package_name" : "python-pyasn1", "cpe" : "cpe:/a:redhat:openstack:16.2" }, { "product_name" : "Red Hat OpenStack Platform 17.1", "fix_state" : "Fix deferred", "package_name" : "python-pyasn1", "cpe" : "cpe:/a:redhat:openstack:17.1" }, { "product_name" : "Red Hat OpenStack Platform 18.0", "fix_state" : "Fix deferred", "package_name" : "rhoso-operators/ee-openstack-ansible-ee-rhel9", "cpe" : "cpe:/a:redhat:openstack:18.0" }, { "product_name" : "Red Hat Quay 3", "fix_state" : "Affected", "package_name" : "quay/quay-rhel9", "cpe" : "cpe:/a:redhat:quay:3" }, { "product_name" : "Red Hat Satellite 6", "fix_state" : "Fix deferred", "package_name" : "python-pyasn1", "cpe" : "cpe:/a:redhat:satellite:6" }, { "product_name" : "Red Hat Satellite 6", "fix_state" : "Fix deferred", "package_name" : "satellite/iop-advisor-backend-rhel9", "cpe" : "cpe:/a:redhat:satellite:6" }, { "product_name" : "Red Hat Satellite 6", "fix_state" : "Fix deferred", "package_name" : "satellite/iop-advisor-engine-rhel9", "cpe" : "cpe:/a:redhat:satellite:6" }, { "product_name" : "Red Hat Trusted Artifact Signer", "fix_state" : "Fix deferred", "package_name" : "rhtas/model-transparency-rhel9", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1" }, { "product_name" : "Red Hat Trusted Artifact Signer", "fix_state" : "Fix deferred", "package_name" : "rhtas/segment-reporting-rhel9", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1" }, { "product_name" : "Service Telemetry Framework 1.5", "fix_state" : "Affected", "package_name" : "stf/prometheus-webhook-snmp-rhel9", "cpe" : "cpe:/a:redhat:stf:1.5" }, { "product_name" : "Service Telemetry Framework 1.5", "fix_state" : "Affected", "package_name" : "stf/service-telemetry-rhel9-operator", "cpe" : "cpe:/a:redhat:stf:1.5" }, { "product_name" : "Service Telemetry Framework 1.5", "fix_state" : "Affected", "package_name" : "stf/smart-gateway-rhel9-operator", "cpe" : "cpe:/a:redhat:stf:1.5" } ], "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-59885\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59885\nhttps://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9\nhttps://github.com/pyasn1/pyasn1/releases/tag/v0.6.4\nhttps://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj" ], "name" : "CVE-2026-59885", "mitigation" : { "value" : "Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.", "lang" : "en:us" }, "csaw" : false }