|
pyasn1 (0.6.3-1ubuntu0.1) resolute-security; urgency=medium
* SECURITY UPDATE: pyasn1 BER/CER/DER decoder denial of service via
unbounded long-form tag IDs
- debian/patches/CVE-2026-59886.patch: Merge commit from fork in
pyasn1/type/univ.py, tests/codec/ber/test_decoder.py,
tests/codec/cer/test_decoder.py, tests/codec/der/test_decoder.py,
tests/type/test_univ.py.
- CVE-2026-59886
* SECURITY UPDATE: Quadratic complexity in OBJECT IDENTIFIER and
RELATIVE-OID processing allows denial of service
- debian/patches/CVE-2026-59884.patch: Merge commit from fork in
pyasn1/codec/ber/decoder.py, pyasn1/type/tag.py,
tests/codec/ber/test_decoder.py, tests/codec/cer/test_decoder.py,
tests/codec/der/test_decoder.py, tests/type/test_tag.py.
- CVE-2026-59884
* SECURITY UPDATE: Uncontrolled resource consumption when converting
decoded REAL values
- debian/patches/CVE-2026-59885.patch: Merge commit from fork in
pyasn1/codec/ber/decoder.py, pyasn1/codec/ber/encoder.py,
tests/codec/ber/test_decoder.py, tests/codec/ber/test_encoder.py.
- CVE-2026-59885
-- Marc Deslauriers Thu, 20 Aug 2026 13:20:40 -0400
|
| CVE-2026-59886 |
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float u |
| CVE-2026-59884 |
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating |
| CVE-2026-59885 |
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in qua |
|
