Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Python's pyasn1 Software Exposes Sensitive Data

published 7 months ago

Summary

A security update is available for Python's pyasn1 software, which could expose sensitive data. If not updated, an attacker could potentially access private information. Update to the latest version to protect your system.

What to do

Update redhat python-pyasn1 to version 0:0.3.7-6.el8_10.1.
Update redhat python3-pyasn1 to version 0:0.3.7-6.el8_10.1.
Update redhat python3-pyasn1-modules to version 0:0.3.7-6.el8_10.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:8::appstream	redhat	python-pyasn1	< 0:0.3.7-6.el8_10.1 Fix: upgrade to 0:0.3.7-6.el8_10.1
Red Hat:enterprise_linux:8::appstream	redhat	python3-pyasn1	< 0:0.3.7-6.el8_10.1 Fix: upgrade to 0:0.3.7-6.el8_10.1
Red Hat:enterprise_linux:8::appstream	redhat	python3-pyasn1-modules	< 0:0.3.7-6.el8_10.1 Fix: upgrade to 0:0.3.7-6.el8_10.1

Original advisory text

Red Hat Security Advisory: python-pyasn1 security update

References

https://access.redhat.com/errata/RHSA-2026:4146 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2430472 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4146.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-23490 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-23490 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-23490 Vendor Advisory
https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970 Third Party Advisory
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2 Third Party Advisory
https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published10 Mar 2026

Updated13 Mar 2026

First seen10 Mar 2026

Sources

RHSA-2026:4146 · OSV

Track software like this

Free during beta