Skip to content

SECURITY-1113: module-cleanup: bump pyasn1 to 0.6.4 fixing CVEs - #379

Open
julianladisch wants to merge 2 commits into
masterfrom
SECURITY-1113
Open

SECURITY-1113: module-cleanup: bump pyasn1 to 0.6.4 fixing CVEs#379
julianladisch wants to merge 2 commits into
masterfrom
SECURITY-1113

Conversation

@julianladisch

@julianladisch julianladisch commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

In kubernetes-utilities/ci-cleanup/module-cleanup/requirements.txt bump pyasn1 from 0.6.3 to 0.6.4 fixing multiple security vulnerabilities, see https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4:

  • CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.
  • CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.
  • CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.
  • Pinned PyPI publish GitHub Action to an immutable commit.

…26-59885

In kubernetes-utilities/ci-cleanup/module-cleanup/requirements.txt
bump pyasn1 from 0.6.3 to 0.6.4 fixing
GHSA-8ppf-4f7h-5ppj = CVE-2026-59885
@julianladisch
julianladisch requested a review from ihardy July 30, 2026 10:01
@julianladisch julianladisch changed the title SECURITY-1113: module-cleanup: bump pyasn1 to 0.6.4 CVE-2026-59885 SECURITY-1113: module-cleanup: bump pyasn1 to 0.6.4 fixing CVEs Jul 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant