mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-20 12:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

python3-pyasn1: Fix CVE-2026-59884

Browse Source 
The BER decoder shared by the CER and DER codecs parses long-form tags by
accumulating continuation octets without an upper bound on the tag ID size.
A crafted input can force construction of an arbitrarily large integer with
CPU cost growing quadratically, and can trigger unhandled ValueError
exceptions in the Python 3.11+ error formatting paths. Any application
decoding untrusted BER, CER, or DER input is affected.

scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.

Pick the upstream patch [1] as mentioned in [2].

[1] 628e36ecbb
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59884

(From OE-Core rev: 75ff4b187cf1b5e4e874cab8273ea84377b3c873)

Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Emily Vekariya
2026-08-21 11:25:50 -07:00
committed by Richard Purdie
parent a2d922f58f
commit d78b160b6c
2 changed files with 246 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/python/python-pyasn1.inc
View File

@@ -20,6 +20,7 @@ SRC_URI += " \
file://run-ptest \
file://CVE-2026-23490.patch \
file://CVE-2026-59886.patch \
file://CVE-2026-59884.patch \
"
RDEPENDS:${PN}-ptest += " \