awscli-1.27.142-py310hff52083_0.conda: 2 vulnerabilities (highest severity is: 7.5)

[mend-bolt-for-github]

Vulnerable Library - awscli-1.27.142-py310hff52083_0.conda

Path to dependency file: /pipelines/deploy/Spark-Single-Node-Notebook-AWS/environment.yml

Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (awscli version)	Remediation Possible**
CVE-2026-30922	High	7.5	pyasn1-0.6.0-py2.py3-none-any.whl	Transitive	N/A*	❌
CVE-2026-23490	High	7.5	pyasn1-0.6.0-py2.py3-none-any.whl	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-30922

Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl

Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)

Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt

Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt

Dependency Hierarchy:

• awscli-1.27.142-py310hff52083_0.conda (Root Library)
  • rsa-4.9-py3-none-any.whl
    • ❌ pyasn1-0.6.0-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the "pyasn1" library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested "SEQUENCE" ("0x30") or "SET" ("0x31") tags with "Indefinite Length" ("0x80") markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a "RecursionError" or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 ("MAX_OID_ARC_CONTINUATION_OCTETS") does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.

Publish Date: 2026-03-18

URL: CVE-2026-30922

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-18

Fix Resolution: https://github.com/pyasn1/pyasn1.git - v0.6.3,pyasn1 - 0.6.3

Step up your Open Source Security Game with Mend here

CVE-2026-23490

Vulnerable Library - pyasn1-0.6.0-py2.py3-none-any.whl

Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)

Library home page: https://files.pythonhosted.org/packages/23/7e/5f50d07d5e70a2addbccd90ac2950f81d1edd0783630651d9268d7f1db49/pyasn1-0.6.0-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt

Path to vulnerable library: /tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730131321/.ws-temp-MPQIJO-requirements.txt,/tmp/ws-ua_20240730130235_KVVOZT/cmd_NQQTWK/20240730130652/.ws-temp-PDFBNV-requirements.txt

Dependency Hierarchy:

• awscli-1.27.142-py310hff52083_0.conda (Root Library)
  • rsa-4.9-py3-none-any.whl
    • ❌ pyasn1-0.6.0-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

Publish Date: 2026-01-16

URL: CVE-2026-23490

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-01-16

Fix Resolution: https://github.com/pyasn1/pyasn1.git - v0.6.2

Step up your Open Source Security Game with Mend here