Skip to content

opentok-3.14.0-py2.py3-none-any.whl: 4 vulnerabilities (highest severity is: 7.5) #269

Open
Open
opentok-3.14.0-py2.py3-none-any.whl: 4 vulnerabilities (highest severity is: 7.5)#269
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

Description

@mend-for-github-com
mend-for-github-com
bot
opened on Jul 15, 2026
Vulnerable Library - opentok-3.14.0-py2.py3-none-any.whl

Path to dependency file: /sample/HelloWorld/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl

Vulnerabilities

Vulnerability Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (opentok version) Remediation Possible** Reachability
CVE-2026-59886 High 7.5 Not Defined 0.335% pyasn1-0.6.3-py3-none-any.whl Transitive N/A* ❌
CVE-2026-59885 High 7.5 Not Defined 0.335% pyasn1-0.6.3-py3-none-any.whl Transitive N/A* ❌
CVE-2026-59884 High 7.5 Not Defined 0.349% pyasn1-0.6.3-py3-none-any.whl Transitive N/A* ❌
CVE-2026-69247 Medium 5.9 Not Defined cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-59886

Vulnerable Library - pyasn1-0.6.3-py3-none-any.whl

Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)

Library home page: https://files.pythonhosted.org/packages/5d/a0/7d793dce3fa811fe047d6ae2431c672364b462850c6235ae306c0efd025f/pyasn1-0.6.3-py3-none-any.whl

Path to dependency file: /tmp/ws-scm/Opentok-Python-SDK

Path to vulnerable library: /tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl

Dependency Hierarchy:

  • opentok-3.14.0-py2.py3-none-any.whl (Root Library)
    • rsa-4.9.1-py3-none-any.whl
      • ❌ pyasn1-0.6.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.

Publish Date: 2026-07-14

URL: CVE-2026-59886

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.335%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hm4w-wwcw-mr6r

Release Date: 2026-07-14

Fix Resolution: pyasn1 - 0.6.4,pyasn1 - 0.6.4,https://github.com/pyasn1/pyasn1.git - v0.6.4

CVE-2026-59885

Vulnerable Library - pyasn1-0.6.3-py3-none-any.whl

Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)

Library home page: https://files.pythonhosted.org/packages/5d/a0/7d793dce3fa811fe047d6ae2431c672364b462850c6235ae306c0efd025f/pyasn1-0.6.3-py3-none-any.whl

Path to dependency file: /tmp/ws-scm/Opentok-Python-SDK

Path to vulnerable library: /tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl

Dependency Hierarchy:

  • opentok-3.14.0-py2.py3-none-any.whl (Root Library)
    • rsa-4.9.1-py3-none-any.whl
      • ❌ pyasn1-0.6.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.

Publish Date: 2026-07-14

URL: CVE-2026-59885

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.335%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8ppf-4f7h-5ppj

Release Date: 2026-07-14

Fix Resolution: pyasn1 - 0.6.4,pyasn1 - 0.6.4,https://github.com/pyasn1/pyasn1.git - v0.6.4

CVE-2026-59884

Vulnerable Library - pyasn1-0.6.3-py3-none-any.whl

Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)

Library home page: https://files.pythonhosted.org/packages/5d/a0/7d793dce3fa811fe047d6ae2431c672364b462850c6235ae306c0efd025f/pyasn1-0.6.3-py3-none-any.whl

Path to dependency file: /tmp/ws-scm/Opentok-Python-SDK

Path to vulnerable library: /tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/pyasn1-0.6.3-py3-none-any.whl

Dependency Hierarchy:

  • opentok-3.14.0-py2.py3-none-any.whl (Root Library)
    • rsa-4.9.1-py3-none-any.whl
      • ❌ pyasn1-0.6.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

Publish Date: 2026-07-14

URL: CVE-2026-59884

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.349%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m4p7-r5rc-7g4j

Release Date: 2026-07-14

Fix Resolution: pyasn1 - 0.6.4,pyasn1 - 0.6.4,https://github.com/pyasn1/pyasn1.git - v0.6.4

CVE-2026-69247

Vulnerable Library - cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/a0/84/84fe36f19caf857d61cb7fc9c63035a47ffabd84ea12d1d393148efa3615/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl

Path to dependency file: /sample/HelloWorld/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl,/tmp/ws-ua_20260626140456_FGUAHG/python_CVORKY/20260626140457/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl

Dependency Hierarchy:

  • opentok-3.14.0-py2.py3-none-any.whl (Root Library)
    • pyjwt-2.13.0-py3-none-any.whl
      • ❌ cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#⁠1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#⁠7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0.

Publish Date: 2026-08-03

URL: CVE-2026-69247

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-g6cj-pr64-35w5

Release Date: 2026-08-03

Fix Resolution: cryptography - 50.0.0,cryptography - 50.0.0

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions