Vulnerable Library - awscli-1.27.142-py310hff52083_0.conda
Universal Command Line Environment for AWS.
Library home page: https://api.anaconda.org/download/conda-forge/awscli/1.27.142/linux-64/awscli-1.27.142-py310hff52083_0.conda
Path to dependency file: /pipelines/deploy/Spark-Single-Node-Notebook-AWS/environment.yml
Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/awscli-1.27.142-py310hff52083_0.conda
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (awscli version) |
Remediation Possible** |
| CVE-2026-59886 |
 High |
7.5 |
pyasn1-0.6.0-py2.py3-none-any.whl |
Transitive |
1.27.143 |
❌ |
| CVE-2026-59885 |
High |
7.5 |
pyasn1-0.6.0-py2.py3-none-any.whl |
Transitive |
1.27.143 |
❌ |
| CVE-2026-59884 |
High |
7.5 |
pyasn1-0.6.0-py2.py3-none-any.whl |
Transitive |
1.27.143 |
❌ |
| CVE-2026-30922 |
High |
7.5 |
pyasn1-0.6.0-py2.py3-none-any.whl |
Transitive |
1.27.143 |
❌ |
| CVE-2026-23490 |
High |
7.5 |
pyasn1-0.6.0-py2.py3-none-any.whl |
Transitive |
N/A* |
❌ |
| CVE-2026-18654 |
 Medium |
6.8 |
awscli-1.27.142-py310hff52083_0.conda |
Direct |
awscli - 1.45.28,awscli - 1.45.28 |
❌ |
| CVE-2026-13769 |
Medium |
5.5 |
awscli-1.27.142-py310hff52083_0.conda |
Direct |
awscli - 1.44.78,awscli - 1.44.78 |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-59886
Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl
Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)
Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt
Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt
Dependency Hierarchy:
- awscli-1.27.142-py310hff52083_0.conda (Root Library)
- rsa-4.9-py3-none-any.whl
- ❌ pyasn1-0.6.0-py2.py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.
Publish Date: 2026-07-14
URL: CVE-2026-59886
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-hm4w-wwcw-mr6r
Release Date: 2026-07-14
Fix Resolution (pyasn1): 0.6.4
Direct dependency fix Resolution (awscli): 1.27.143
Step up your Open Source Security Game with Mend here
CVE-2026-59885
Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl
Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)
Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt
Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt
Dependency Hierarchy:
- awscli-1.27.142-py310hff52083_0.conda (Root Library)
- rsa-4.9-py3-none-any.whl
- ❌ pyasn1-0.6.0-py2.py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
Publish Date: 2026-07-14
URL: CVE-2026-59885
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-8ppf-4f7h-5ppj
Release Date: 2026-07-14
Fix Resolution (pyasn1): 0.6.4
Direct dependency fix Resolution (awscli): 1.27.143
Step up your Open Source Security Game with Mend here
CVE-2026-59884
Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl
Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)
Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt
Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt
Dependency Hierarchy:
- awscli-1.27.142-py310hff52083_0.conda (Root Library)
- rsa-4.9-py3-none-any.whl
- ❌ pyasn1-0.6.0-py2.py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
Publish Date: 2026-07-14
URL: CVE-2026-59884
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-m4p7-r5rc-7g4j
Release Date: 2026-07-14
Fix Resolution (pyasn1): 0.6.4
Direct dependency fix Resolution (awscli): 1.27.143
Step up your Open Source Security Game with Mend here
CVE-2026-30922
Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl
Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)
Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt
Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt
Dependency Hierarchy:
- awscli-1.27.142-py310hff52083_0.conda (Root Library)
- rsa-4.9-py3-none-any.whl
- ❌ pyasn1-0.6.0-py2.py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the "pyasn1" library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested "SEQUENCE" ("0x30") or "SET" ("0x31") tags with "Indefinite Length" ("0x80") markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a "RecursionError" or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 ("MAX_OID_ARC_CONTINUATION_OCTETS") does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
Publish Date: 2026-03-18
URL: CVE-2026-30922
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-18
Fix Resolution (pyasn1): 0.6.3
Direct dependency fix Resolution (awscli): 1.27.143
Step up your Open Source Security Game with Mend here
CVE-2026-23490
Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl
Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)
Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt
Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt
Dependency Hierarchy:
- awscli-1.27.142-py310hff52083_0.conda (Root Library)
- rsa-4.9-py3-none-any.whl
- ❌ pyasn1-0.6.0-py2.py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.
Publish Date: 2026-01-16
URL: CVE-2026-23490
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-01-16
Fix Resolution: https://github.com/pyasn1/pyasn1.git - v0.6.2
Step up your Open Source Security Game with Mend here
CVE-2026-18654
Vulnerable Library - awscli-1.27.142-py310hff52083_0.conda
Universal Command Line Environment for AWS.
Library home page: https://api.anaconda.org/download/conda-forge/awscli/1.27.142/linux-64/awscli-1.27.142-py310hff52083_0.conda
Path to dependency file: /pipelines/deploy/Spark-Single-Node-Notebook-AWS/environment.yml
Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/awscli-1.27.142-py310hff52083_0.conda
Dependency Hierarchy:
- ❌ awscli-1.27.142-py310hff52083_0.conda (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint.
To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
Publish Date: 2026-08-03
URL: CVE-2026-18654
CVSS 3 Score Details (6.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-hqvf-45jj-mccq
Release Date: 2026-08-03
Fix Resolution: awscli - 1.45.28,awscli - 1.45.28
Step up your Open Source Security Game with Mend here
CVE-2026-13769
Vulnerable Library - awscli-1.27.142-py310hff52083_0.conda
Universal Command Line Environment for AWS.
Library home page: https://api.anaconda.org/download/conda-forge/awscli/1.27.142/linux-64/awscli-1.27.142-py310hff52083_0.conda
Path to dependency file: /pipelines/deploy/Spark-Single-Node-Notebook-AWS/environment.yml
Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/awscli-1.27.142-py310hff52083_0.conda
Dependency Hierarchy:
- ❌ awscli-1.27.142-py310hff52083_0.conda (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).
To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.
Publish Date: 2026-07-01
URL: CVE-2026-13769
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-wfp6-f47h-hxc3
Release Date: 2026-07-01
Fix Resolution: awscli - 1.44.78,awscli - 1.44.78
Step up your Open Source Security Game with Mend here
Universal Command Line Environment for AWS.
Library home page: https://api.anaconda.org/download/conda-forge/awscli/1.27.142/linux-64/awscli-1.27.142-py310hff52083_0.conda
Path to dependency file: /pipelines/deploy/Spark-Single-Node-Notebook-AWS/environment.yml
Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/awscli-1.27.142-py310hff52083_0.conda
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl
Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)
Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt
Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.
Publish Date: 2026-07-14
URL: CVE-2026-59886
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-hm4w-wwcw-mr6r
Release Date: 2026-07-14
Fix Resolution (pyasn1): 0.6.4
Direct dependency fix Resolution (awscli): 1.27.143
Step up your Open Source Security Game with Mend here
Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl
Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)
Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt
Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
Publish Date: 2026-07-14
URL: CVE-2026-59885
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-8ppf-4f7h-5ppj
Release Date: 2026-07-14
Fix Resolution (pyasn1): 0.6.4
Direct dependency fix Resolution (awscli): 1.27.143
Step up your Open Source Security Game with Mend here
Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl
Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)
Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt
Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
Publish Date: 2026-07-14
URL: CVE-2026-59884
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-m4p7-r5rc-7g4j
Release Date: 2026-07-14
Fix Resolution (pyasn1): 0.6.4
Direct dependency fix Resolution (awscli): 1.27.143
Step up your Open Source Security Game with Mend here
Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl
Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)
Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt
Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the "pyasn1" library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested "SEQUENCE" ("0x30") or "SET" ("0x31") tags with "Indefinite Length" ("0x80") markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a "RecursionError" or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 ("MAX_OID_ARC_CONTINUATION_OCTETS") does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
Publish Date: 2026-03-18
URL: CVE-2026-30922
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-03-18
Fix Resolution (pyasn1): 0.6.3
Direct dependency fix Resolution (awscli): 1.27.143
Step up your Open Source Security Game with Mend here
Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl
Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)
Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt
Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.
Publish Date: 2026-01-16
URL: CVE-2026-23490
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-01-16
Fix Resolution: https://github.com/pyasn1/pyasn1.git - v0.6.2
Step up your Open Source Security Game with Mend here
Vulnerable Library - awscli-1.27.142-py310hff52083_0.conda
Universal Command Line Environment for AWS.
Library home page: https://api.anaconda.org/download/conda-forge/awscli/1.27.142/linux-64/awscli-1.27.142-py310hff52083_0.conda
Path to dependency file: /pipelines/deploy/Spark-Single-Node-Notebook-AWS/environment.yml
Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/awscli-1.27.142-py310hff52083_0.conda
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint.
To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
Publish Date: 2026-08-03
URL: CVE-2026-18654
CVSS 3 Score Details (6.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-hqvf-45jj-mccq
Release Date: 2026-08-03
Fix Resolution: awscli - 1.45.28,awscli - 1.45.28
Step up your Open Source Security Game with Mend here
Vulnerable Library - awscli-1.27.142-py310hff52083_0.conda
Universal Command Line Environment for AWS.
Library home page: https://api.anaconda.org/download/conda-forge/awscli/1.27.142/linux-64/awscli-1.27.142-py310hff52083_0.conda
Path to dependency file: /pipelines/deploy/Spark-Single-Node-Notebook-AWS/environment.yml
Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/awscli-1.27.142-py310hff52083_0.conda
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).
To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.
Publish Date: 2026-07-01
URL: CVE-2026-13769
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-wfp6-f47h-hxc3
Release Date: 2026-07-01
Fix Resolution: awscli - 1.44.78,awscli - 1.44.78
Step up your Open Source Security Game with Mend here