1223 matches found
TWSL2011-007_iOS_code_workaround
= testcert Reference implementation for TWSL2011-007 vulnerability workaround aka CVE-2011-0228. Author: Eric Monti Date: July 28, 2011 = Compiling Compile with your Apple iOS SDK CFLAGS along with: gcc -o testcert testcert.m -framework Foundation -framework Security The compile arguments above...
CVE-2026-119197
The pyasn1 Python ASN.1 library is vulnerable to a denial of service (DoS) via quadratic-complexity decoding in its binary REAL decoding logic. In versions prior to 0.6.5 , the RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet. An attac...
CVE-2026-119196
The pyasn1 Python library (prior to version 0.6.5 ) is vulnerable to a quadratic CPU consumption issue during constructed BIT STRING decoding . The BitStringPayloadDecoder repeatedly calls BitString.fromOctetString, shifting and copying an ever-growing SizedInteger for each fragment in BER , CER ...
EUVD-2026-113351
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER reject...
CVE-2026-119195
The pyasn1 library for Python, versions prior to 0.6.5 , is vulnerable to a quadratic-time denial of service. The root cause is located in OctuetStringPayloadDecoder and AnyPayloadDecoder.indefLenValueDecoder , which repeatedly concatenate fragments onto a growing bytes value during constructed s...
CVE-2026-119194
The pyasn1 Python library (versions 0.3.3 through 0.6.5 ) is vulnerable to a quadratic CPU use issue during schemaless BER, CER, or DER container decoding. The root cause lies in the ConstructedPayloadDecoderBase._decodeComponentsSchemaless function, where the application stores every decoded com...
go-pkcs12
package pkcs12 import "software.sslmate.com/src/go-pkcs12" Package pkcs12 implements some of PKCS12 also known as P12 or PFX. It is intended for decoding DER-encoded P12/PFX files for use with the crypto/tls package, and for encoding P12/PFX files for use by legacy applications which do not suppo...
heimdal
Heimdal Heimdal is an implementation of: ASN.1/DER, PKIX, and Kerberos. For information how to install see here. There are man pages for most of the commands. Bug reports and bugs are appreciated. Use GitHub issues. For more information see the project homepage https://heimdal.software/heimdal/ o...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in pyasn1 (CVE-2026-59884, CVE-2026-59885, CVE-2026-59886)
Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in pyasn1, due to issues with BER, CER, and DER encoder/decoder processes. Pyasn1 is used in our Speech runtimes. These vulnerabilities have been addressed. Please read the details for remediation...
pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets
A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules DER format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code HMAC operations. If an application supports both asymmetric and...
Astra Linux – Vulnerability in libtomcrypt
In LibTomCrypt version 1.18.2, the derdecodeutf8string function located in derdecodeutf8string.c does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service such as out-of-bounds reads and crashes or to read information from other...
Astra Linux – vulnerability in mbedtls
An issue was found in Arm Mbed TLS prior to version 2.24.0. mbedtlsx509crlparseder contains a buffer over-read of one byte...
Astra Linux – Vulnerability in gnutls28
A flaw was discovered in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a speciall...
python-jose algorithm confusion guard bypassed by DER-encoded public keys
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...
PYSEC-2026-4298 python-jose algorithm confusion guard bypassed by DER-encoded public keys
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...
USN-8916-2: PyJWT vulnerabilities
USN-8916-1 fixed vulnerabilities in PyJWT. This update provides the corresponding fix for PyJWT on Ubuntu 26.10. Original advisory details: YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to...
USN-8916-2 pyjwt vulnerabilities
USN-8916-1 fixed vulnerabilities in PyJWT. This update provides the corresponding fix for PyJWT on Ubuntu 26.10. Original advisory details: YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : PyJWT vulnerabilities (USN-8916-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8916-1 advisory. YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC...
CVE-2026-73260
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...
UBUNTU-CVE-2026-73260
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...