The univ.Real type converts its mantissa, base, and exponent to a Python
float using exact big-integer exponentiation. A BER, CER, or DER encoded
REAL value only a few bytes long can carry a very large exponent, causing
float conversion through prettyPrint(), str(), comparison, arithmetic,
int(), or an explicit float() call to consume excessive CPU and memory and
hang applications that decode untrusted ASN.1 data and then print, log, or
compare the decoded objects.
scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.
Pick the upstream patch [1] as mentioned in [2].
[1] e60c691cb9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59886
(From OE-Core rev: 24991f7383dbe229a696ad209ae7d58115a051a1)
Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a
Denial-of-Service issue has been found that leads to memory exhaustion
from malformed RELATIVE-OID with excessive continuation octets. This
vulnerability is fixed in 0.6.2.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-23490
(From OE-Core rev: 205d360b49c7bbaa8709cb5a0b2e57457c32ad22)
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
python 2 is gone and we don't need the abstraction now, drop the remaining usage
of this variable.
The definition in python3-dir.bbclass is left for now for other layers.
(From OE-Core rev: b566b1e32c7993d1ab7795562f648e52ce186a70)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
============
-Added support for PyPy 3.10 and Python 3.12
-Updated RTD configuration to include a dummy index.rst redirecting to
contents.html, ensuring compatibility with third-party documentation and search
indexes.
-Fixed the API breakage wih decoder.decode(substrateFun=...).
(From OE-Core rev: 42e32865f9c3f075243b2f4110c2c81bfbe78441)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
License-Update: copyright years
(From OE-Core rev: d36e4228bd94ae9a9ca0feeaa9541ed5afafdd44)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of using sed to reformat the output use this new module.
(From OE-Core rev: d83b60647bcbd32f57796085ed5f8e19c30e576a)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Eliminated the ptest deprecation warnings for the error:
DeprecationWarning: _int_ returned non-int (type SizedInteger).
The ability to return an instance of a strict subclass of int is deprecated,
and may be removed in a future version of Python.
return SizedInteger(value).setBitLength(len(value))
Patch from git upstream repo:
db8f1a7930
(From OE-Core rev: ac674d95820137306e7c71f4275d92cf4fedf39d)
Signed-off-by: Yulong (Kevin) Liu <yulong.liu@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
