-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 24 Aug 2026 17:02:31 -0300 Source: pyasn1 Architecture: source Version: 0.6.1-1+deb13u3 Distribution: trixie Urgency: high Maintainer: Debian Python Team <[email protected]> Changed-By: Emmanuel Arias <[email protected]> Closes: 1142388 Changes: pyasn1 (0.6.1-1+deb13u3) trixie; urgency=high . * Team upload. * CVE-2026-59886: uncontrolled resource consumption when converting decoded real values. univ.Real convertedts mantissa, base, exponens to a Python float using exact big-integer exponentiation, so a real value only a few bytes long could carry a very large exponent. * CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs. The BER decoder accumulated tag continuation octets without an upper bound, so a crafted substrate could force construction of an arbitrarily large integer with quadratic CPU cost (Closes: #1142388). * CVE-2026-59885: fix quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID decoding and encoding, which allowed denial of service via a small payload with many arcs. Checksums-Sha1: 525881501d807c000c45f7e8b0ba8f4f7ef0ad3c 2316 pyasn1_0.6.1-1+deb13u3.dsc ae93682a9df09a73f2154f4ae9ec5dd3f0830f20 145322 pyasn1_0.6.1.orig.tar.gz c94f534b7f5cd56c557780e88fbad2808dd42ab6 14332 pyasn1_0.6.1-1+deb13u3.debian.tar.xz d2af811dd25dd360a312f94eba356289de98833b 8848 pyasn1_0.6.1-1+deb13u3_source.buildinfo Checksums-Sha256: bba418ac9b5fe8c734b17096b10b16f9a381942d7f9be1bbb0c70daf24d4d655 2316 pyasn1_0.6.1-1+deb13u3.dsc 6f580d2bdd84365380830acf45550f2511469f673cb4a5ae3857a3170128b034 145322 pyasn1_0.6.1.orig.tar.gz dbcc3d55563558ba54b44b52c894dc0562717f6187fe4f2ebb028a75931c1ec7 14332 pyasn1_0.6.1-1+deb13u3.debian.tar.xz 69186529f30178f569238495871fca27c365f4074ae12e8e7a9a69877539d4f4 8848 pyasn1_0.6.1-1+deb13u3_source.buildinfo Files: d1bdc843cf7b60771bbefed9a8b7a11b 2316 python optional pyasn1_0.6.1-1+deb13u3.dsc 75cdc260597f112fdfefec85379e710d 145322 python optional pyasn1_0.6.1.orig.tar.gz c524a4cb679829e1b8c5cdb88bf8d949 14332 python optional pyasn1_0.6.1-1+deb13u3.debian.tar.xz e14c824007b3174c0cc33d2b61838908 8848 python optional pyasn1_0.6.1-1+deb13u3_source.buildinfo
-----BEGIN PGP SIGNATURE----- iQJGBAEBCgAwFiEEE3lnVbvHK7ir4q61+p3sXeEcY/EFAmqbHkISHGVhbWFudUBk ZWJpYW4ub3JnAAoJEPqd7F3hHGPxZVoP/2up/vYHOLHN+toY8JD0x//Jxy4HvsZe M+TNxB4RXZohU14AFKoIWStWZgrrJjxHEGJ8fo1COuFPmCqpOrxhPivLQnZokM3r 2rEN8DMgIbfHab7Q2xkIxwo+k+cKw+OG3/ZhU8bqwt9anOmyYWjxykm0ss9dKYe/ DVWFOskw3mPGb6tG2PmMVf1iUktgZ4GiHfyhm6OHDKxAYvSl1OR67n9iGzjLADkT 3jNpjnkrX+L0j1edlqQiLo2kgSnZENJ6b97FqNhE6Di8B5yDJyLlgvSRt492pFKJ 2Txgb5r7ZYGkQjTWaZUOs/dEEuU/rkLwql5+b5Ojpltc7g6vRm+FoxQPNGlfrxnG +IzUAd+xKBidpS4WX+2KhJ2n+AhNSpUhr6EdfFI5W9yW3ZzeCZFcx5sySU5c3LqG iB5OH0dTxb4BPQeXXXrEciGz2ntsyhNvaK4+opo5BJemXhxVXy2PQlM1BdaMQRms I7pT8BU3HCwuXuCLA1EMKQHCF+dLVYhHLtDJmK3gKG/WaITAH7L/gSCgvLVPHYcS KXtbx02zRv8PugONQtYNxGh0XAnPoaC0pzodtvngGw+3sh7pwLsR77cqjm1DePuT 507/4PQlO8vk621d8DtYXbPCkB+DICU+MD6pLlR1/NAVKSrRa2z2VQiN/MV+9wxY u338RHg9rjgJ =2XRP -----END PGP SIGNATURE-----
pgpj2bjvYlHDE.pgp
Description: PGP signature
