An update of the python3 package has been released.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:12176 advisory.

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)
      * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation)     (CVE-2026-32597)
      * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:13916 advisory.

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)
      * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13916 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

    * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3215 advisory.

    pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a     Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply     nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE`     (`0x30`) or `SET` (`0x31`) tags with Indefinite Length (`0x80`) markers. This forces the decoder to     recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all     available memory (OOM), crashing the host application. This is a distinct vulnerability from     CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490     (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this     specific issue. (CVE-2026-30922)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6194 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6194-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     April 03, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : pyasn1     CVE ID         : CVE-2026-30922     Debian Bug     : 1131371

    It was discovered that pyasn1, a generic ASN.1 library for Python, is     prone to a denial of service vulnerability when decoding ASN.1 data with     deeply nested structures.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 0.4.8-3+deb12u2.

    For the stable distribution (trixie), this problem has been fixed in     version 0.6.1-1+deb13u2.

    We recommend that you upgrade your pyasn1 packages.

    For the detailed security status of pyasn1 please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/pyasn1

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4557 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4557-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Emmanuel Arias     May 01, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : pyasn1     Version        : 0.4.8-1+deb11u2     CVE ID         : CVE-2026-30922     Debian Bug     : 1131371

    It was discovered that pyasn1, a generic ASN.1 library for Python, is vulnerable     to a Denial of Service (DoS) attack caused by uncontrolled recursion when     decoding ASN.1 data with deeply nested structures. This vulnerability can force     the decoder to recursively call itself until the Python interpreter crashes with a     `RecursionError` or consumes all available memory, crashing the host application.

    For Debian 11 bullseye, this problem has been fixed in version     0.4.8-1+deb11u2.

    We recommend that you upgrade your pyasn1 packages.

    For the detailed security status of pyasn1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/pyasn1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:13917 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-13916 advisory.

    - bundled pyasn1: replace with dependency to fix CVE-2026-30922

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:13902 advisory.

    The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts.
    These scripts interface with several services to allow operating in a high-availability (HA) environment.

    Security Fix(es):

    * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-602:05 advisory.

    * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
306347	Photon OS 5.0: Python3 PHSA-2026-5.0-0813	Nessus	PhotonOS Local Security Checks	2026/4/14	2026/4/14	high
311296	AlmaLinux 8 : fence-agents (ALSA-2026:12176)	Nessus	Alma Linux Local Security Checks	2026/4/30	2026/4/30	high
312683	AlmaLinux 10 : fence-agents (ALSA-2026:13916)	Nessus	Alma Linux Local Security Checks	2026/5/6	2026/5/6	high
312389	RHEL 10 : fence-agents (RHSA-2026:13916)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/6	high
304577	Amazon Linux 2 : python-pyasn1, --advisory ALAS2-2026-3215 (ALAS-2026-3215)	Nessus	Amazon Linux Local Security Checks	2026/4/1	2026/4/1	high
304943	Debian dsa-6194 : python-pyasn1-doc - security update	Nessus	Debian Local Security Checks	2026/4/5	2026/4/6	high
311489	Debian dla-4557 : pypy-pyasn1 - security update	Nessus	Debian Local Security Checks	2026/5/2	2026/5/2	high
312399	RHEL 9 : fence-agents (RHSA-2026:13917)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/6	high
312671	Oracle Linux 10 : fence-agents (ELSA-2026-13916)	Nessus	Oracle Linux Local Security Checks	2026/5/6	2026/5/6	high
312337	RHEL 8 : resource-agents (RHSA-2026:13902)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/6	high
314296	MiracleLinux 8 : resource-agents-4.9.0-54.el8_10.33 (AXSA:2026-602:05)	Nessus	Miracle Linux Local Security Checks	2026/5/12	2026/5/12	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high