Duplicity versions prior to 3.1.0_2 use Paramiko's rsakey.py module which allows the use of the SHA-1 algorithm. This cryptographic choice is considered weak and deprecated. The vulnerability has a low CVSS score and does not impact confidentiality or availability but may allow limited integrity issues. A fix is available in version 3.1.0_2.
The pyasn1 library suffers from a Denial of Service vulnerability due to unbounded recursion when decoding ASN.1 data with deeply nested indefinite-length SEQUENCE or SET tags. An attacker can craft a payload that causes the decoder to recurse excessively, leading to a RecursionError or out-of-memory crash, terminating the service process. This affects services parsing untrusted ASN.1 data such as LDAP, SNMP, Kerberos, or X.509 parsers. The vulnerability is fixed in pyasn1 versions 0.8.03 and 3.0.7_7.
A denial-of-service (DoS) vulnerability exists in pyasn1 version 0.6.1 used by Duplicity, caused by memory exhaustion when decoding malformed RELATIVE-OID values with excessive continuation octets. This flaw can cause systems processing malicious ASN.1 data, such as LDAP servers or TLS/SSL endpoints, to hang or crash due to resource exhaustion. The issue is fixed in pyasn1 version 3.0.7_4.
A path traversal vulnerability in setuptools' PackageIndex.download function allows an attacker to write files to arbitrary filesystem locations with the permissions of the running process. This flaw arises from insufficient sanitization of URL-derived filenames, enabling path traversal despite some replacement of '..' sequences. The vulnerability was fixed in setuptools version 78.1.1. Although the affected components like easy_install and package_index are deprecated, exploitation could lead to arbitrary file write and potentially remote code execution depending on context.
CVE-2024-6345 is a high-severity vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1. It allows remote code execution via command injection through download functions that handle package URLs. This flaw can be exploited if user-controlled inputs are passed to these functions, enabling arbitrary command execution on the affected system. The vulnerability is fixed in setuptools version 70.0. The affected product duplicity includes vulnerable versions prior to 0.7.09_1 and 2.2.3, with patches available.
The httplib2 HTTP client library is vulnerable to a decompression bomb denial of service (DoS) attack via unbounded gzip or deflate response handling. A malicious HTTP server can send a small compressed payload that decompresses to a very large size in memory, causing the client process to run out of memory or crash. This affects any application using httplib2.Http().request() with untrusted HTTP endpoints. The vulnerability is fixed in version 3.1.0_2.
MessagePack for Python's Unpacker component has a vulnerability where reusing the same Unpacker instance after an error can cause a process crash (segmentation fault). This can lead to denial-of-service (DoS) conditions if untrusted input triggers repeated errors. The issue is fixed in version 3.1.0_1. Users are advised to create a new Unpacker after an error instead of reusing the existing one. The patch prevents crashes but does not change the need to discard the Unpacker after errors to avoid incorrect data processing.
A vulnerability in the pyasn1 library's handling of ASN.1 REAL values allows an attacker to cause excessive CPU and memory consumption during float conversion of decoded REAL values with large exponents. This can lead to denial of service (DoS) when operations like printing, logging, or comparing such values are performed. The issue affects pyasn1 versions from 3.4 up to but not including 3.4_1 and has been fixed in version 3.4_1.
A denial of service vulnerability exists in pyasn1's BER/CER/DER decoders and encoders when processing OBJECT IDENTIFIER and RELATIVE-OID values. The decoding and encoding operations exhibit quadratic time complexity relative to the number of arcs, allowing a crafted payload with many arcs to consume excessive CPU resources. This affects applications decoding untrusted ASN.1 data such as certificates, LDAP, SNMP, and Kerberos. The issue is fixed in pyasn1 version 3.4_1.
CVE-2026-59884 is a denial of service vulnerability in the pyasn1 library's BER/CER/DER decoders caused by unbounded long-form tag IDs. The decoder accumulates continuation octets without an upper limit, allowing crafted inputs to cause excessive CPU consumption. On Python 3.11 and later, this can also trigger an unhandled ValueError during error message formatting, potentially bypassing error handling. The issue affects decoding of untrusted BER/CER/DER inputs and was fixed in pyasn1 version 3.4_1 by limiting tag IDs to 20 octets and rejecting oversized tags.
AWS CLI versions 1.13.0 through 1.44.37 (v1) and 2.0.0 through 2.33.20 (v2) have a vulnerability in the cli_history feature where the history database file is created with default Unix file permissions. This can allow other local users on multi-user Unix systems to read sensitive command history data. The issue affects only users who have explicitly enabled cli_history, which is disabled by default. The vulnerability is fixed in AWS CLI versions 1.44.38 and 2.33.21.
AWS CLI versions up to 1.45.27 (v1) and 2.35.2 (v2) contain a vulnerability in EMR SSH helper commands where SSH host key verification is disabled by passing StrictHostKeyChecking=no to the SSH client. This allows a network-positioned attacker to perform man-in-the-middle attacks on SSH sessions and file transfers between the client and EMR cluster instances, potentially exposing commands, files, and credentials. The issue is fixed in AWS CLI v1 1.45.28 and v2 2.35.3. No workaround exists as the insecure SSH option was hardcoded and not user-overridable.
Certain AWS CLI subcommands on Unix-like systems with default umask settings wrote credential and configuration files with overly permissive world-readable permissions (0644) instead of owner-only (0600). This could allow other local users on the same host to read sensitive credentials. The affected AWS CLI versions are v1 up to 1.44.77 and v2 up to 2.34.28. The issue has been fixed in AWS CLI v1 version 1.44.78 and v2 version 2.34.29.