pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.6.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The pyasn1 library, a generic ASN.1 decoder for Python, is affected in versions up to 0.6.5 when it decodes BER, CER, or DER data without a schema. Crafted input with many specially constructed tags can cause excessive CPU use during decoding, which can slow or disrupt services that parse such data.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- pyasn1 pyasn1
From 0.3.3 · fixed in 0.6.5