Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

PyASN1 in Red Hat Python Package Updated to Fix Security Issue

published 7 months ago

Summary

The Red Hat Python package, pyasn1, has been updated to fix a security issue that could allow an attacker to execute arbitrary code. This update is recommended for users running Python applications that use the pyasn1 library. Update your system to the latest version to ensure you have the latest security patches.

What to do

Update redhat python-pyasn1 to version 0:0.6.2-1.el10_0.1.
Update redhat python3-pyasn1 to version 0:0.6.2-1.el10_0.1.
Update redhat python3-pyasn1-modules to version 0:0.6.2-1.el10_0.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux_eus:10.0	redhat	python-pyasn1	< 0:0.6.2-1.el10_0.1 Fix: upgrade to 0:0.6.2-1.el10_0.1
Red Hat:enterprise_linux_eus:10.0	redhat	python3-pyasn1	< 0:0.6.2-1.el10_0.1 Fix: upgrade to 0:0.6.2-1.el10_0.1
Red Hat:enterprise_linux_eus:10.0	redhat	python3-pyasn1-modules	< 0:0.6.2-1.el10_0.1 Fix: upgrade to 0:0.6.2-1.el10_0.1

Original advisory text

Red Hat Security Advisory: python-pyasn1 security update

References

https://access.redhat.com/errata/RHSA-2026:4138 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2430472 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4138.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-23490 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-23490 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-23490 Vendor Advisory
https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970 Third Party Advisory
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2 Third Party Advisory
https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published10 Mar 2026

Updated13 Mar 2026

First seen10 Mar 2026

Sources

RHSA-2026:4138 · OSV

Track software like this

Free during beta