Source: pyasn1 Version: 0.6.3-1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for pyasn1. CVE-2026-59884[0]: | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the | BER decoder shared by the CER and DER codecs parses long-form tags | by accumulating continuation octets without an upper bound on the | tag ID size, allowing a crafted input to force construction of an | arbitrarily large integer with CPU cost growing quadratically and to | trigger unhandled ValueError exceptions in Python 3.11+ error | formatting paths. Any application decoding untrusted BER, CER, or | DER input is affected. This issue is fixed in version 0.6.4. CVE-2026-59885[1]: | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the | BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE- | OID values in quadratic time relative to the number of arcs, so a | small crafted payload containing an OID with many arcs consumes | excessive CPU per decode() call and can deny service to applications | that decode untrusted ASN.1 data. The corresponding encoders have | the same quadratic behavior when an application re-encodes | previously decoded attacker-supplied values. This issue is fixed in | version 0.6.4. CVE-2026-59886[2]: | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the | univ.Real type converted its mantissa, base, and exponent value to a | Python float using exact big-integer exponentiation. A BER, CER, or | DER encoded REAL value only a few bytes long can carry a very large | exponent, causing float conversion through prettyPrint(), str(), | comparison, arithmetic, int(), or an explicit float() call to | consume excessive CPU and memory and hang applications that decode | untrusted ASN.1 data and then print, log, or compare decoded | objects. This issue is fixed in version 0.6.4. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-59884 https://www.cve.org/CVERecord?id=CVE-2026-59884 [1] https://security-tracker.debian.org/tracker/CVE-2026-59885 https://www.cve.org/CVERecord?id=CVE-2026-59885 [2] https://security-tracker.debian.org/tracker/CVE-2026-59886 https://www.cve.org/CVERecord?id=CVE-2026-59886 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
