UbuntuUpdates.org

Package "pyasn1"

Name: pyasn1

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • ASN.1 library for Python (documentation)
  • ASN.1 library for Python (Python 3 module)
Latest version: 0.4.8-4ubuntu0.4
Release: noble (24.04)
Level: security
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "pyasn1" in Noble

Repository Area Version
base main 0.4.8-4
updates main 0.4.8-4ubuntu0.3

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 0.4.8-4ubuntu0.4 2026-11-09 18:08:04 UTC

pyasn1 (0.4.8-4ubuntu0.4) noble-security; urgency=medium

  * SECURITY UPDATE: DoS via quadratic binary REAL decoding
    - debian/patches/CVE-2026-119197.patch: decode the REAL mantissa in a
      single conversion in pyasn1/codec/ber/decoder.py,
      tests/codec/ber/test_decoder.py, tests/codec/cer/test_decoder.py,
      tests/codec/der/test_decoder.py.
    - CVE-2026-119197
  * SECURITY UPDATE: DoS via quadratic constructed BIT STRING decoding
    - debian/patches/CVE-2026-119196.patch: assemble constructed BIT STRING
      fragments in linear time in pyasn1/codec/ber/decoder.py,
      tests/codec/ber/test_decoder.py, tests/codec/cer/test_decoder.py,
      tests/codec/der/test_decoder.py.
    - CVE-2026-119196
  * SECURITY UPDATE: DoS via quadratic schemaless container decoding
    - debian/patches/CVE-2026-119194.patch: stop collecting tag sets once two
      distinct types are seen in pyasn1/codec/ber/decoder.py.
    - CVE-2026-119194

 -- Charles Cochran Wed, 04 Nov 2026 14:17:47 -0600
Source diff to previous version
CVE-2026-119197 pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing
CVE-2026-119196 pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value acc
CVE-2026-119194 pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a grow

Version: 0.4.8-4ubuntu0.3 2026-09-01 18:07:40 UTC

pyasn1 (0.4.8-4ubuntu0.3) noble-security; urgency=medium

  * SECURITY UPDATE: pyasn1 BER/CER/DER decoder denial of service via
    unbounded long-form tag IDs
    - debian/patches/CVE-2026-59886.patch: Merge commit from fork in
      pyasn1/type/univ.py, tests/codec/ber/test_decoder.py,
      tests/codec/cer/test_decoder.py, tests/codec/der/test_decoder.py,
      tests/type/test_univ.py.
    - CVE-2026-59886
  * SECURITY UPDATE: Quadratic complexity in OBJECT IDENTIFIER and
    RELATIVE-OID processing allows denial of service
    - debian/patches/CVE-2026-59884.patch: Merge commit from fork in
      pyasn1/codec/ber/decoder.py, pyasn1/type/tag.py,
      tests/codec/ber/test_decoder.py, tests/codec/cer/test_decoder.py,
      tests/codec/der/test_decoder.py, tests/type/test_tag.py.
    - CVE-2026-59884
  * SECURITY UPDATE: Uncontrolled resource consumption when converting
    decoded REAL values
    - debian/patches/CVE-2026-59885.patch: Merge commit from fork in
      pyasn1/codec/ber/decoder.py, pyasn1/codec/ber/encoder.py,
      tests/codec/ber/test_decoder.py, tests/codec/ber/test_encoder.py.
    - CVE-2026-59885

 -- Marc Deslauriers Thu, 20 Aug 2026 13:36:50 -0400
Source diff to previous version
CVE-2026-59886 pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float u
CVE-2026-59884 pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating
CVE-2026-59885 pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in qua

Version: 0.4.8-4ubuntu0.2 2026-03-30 14:07:58 UTC

  pyasn1 (0.4.8-4ubuntu0.2) noble-security; urgency=medium

  * SECURITY UPDATE: DoS via uncontrolled recursion
    - debian/patches/CVE-2026-30922.patch: limit nesting depth in
      pyasn1/codec/ber/decoder.py, tests/codec/ber/test_decoder.py,
      tests/codec/cer/test_decoder.py, tests/codec/der/test_decoder.py.
    - CVE-2026-30922

 -- Marc Deslauriers <email address hidden> Mon, 23 Mar 2026 12:14:38 -0400
Source diff to previous version
CVE-2026-30922 pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncont

Version: 0.4.8-4ubuntu0.1 2026-01-22 22:18:53 UTC

  pyasn1 (0.4.8-4ubuntu0.1) noble-security; urgency=medium

  * SECURITY UPDATE: memory exhaustion from malformed RELATIVE-OID
    - debian/patches/CVE-2026-23490.patch: add limit of 20 continuation
      octets per OID arc in pyasn1/codec/ber/decoder.py,
      tests/codec/ber/test_decoder.py.
    - CVE-2026-23490

 -- Marc Deslauriers <email address hidden> Tue, 20 Jan 2026 10:40:22 -0500
CVE-2026-23490 pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed


About   -   Send Feedback to @ubuntu_updates