mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
a2d922f58f
The univ.Real type converts its mantissa, base, and exponent to a Python
float using exact big-integer exponentiation. A BER, CER, or DER encoded
REAL value only a few bytes long can carry a very large exponent, causing
float conversion through prettyPrint(), str(), comparison, arithmetic,
int(), or an explicit float() call to consume excessive CPU and memory and
hang applications that decode untrusted ASN.1 data and then print, log, or
compare the decoded objects.
scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.
Pick the upstream patch [1] as mentioned in [2].
[1] e60c691cb9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59886
(From OE-Core rev: 24991f7383dbe229a696ad209ae7d58115a051a1)
Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
34 lines
768 B
PHP
34 lines
768 B
PHP
SUMMARY = "Python library implementing ASN.1 types."
|
|
HOMEPAGE = "http://pyasn1.sourceforge.net/"
|
|
LICENSE = "BSD-2-Clause"
|
|
LIC_FILES_CHKSUM = "file://LICENSE.rst;md5=190f79253908c986e6cacf380c3a5f6d"
|
|
|
|
SRC_URI[sha256sum] = "6d391a96e59b23130a5cfa74d6fd7f388dbbe26cc8f1edf39fdddf08d9d6676c"
|
|
|
|
RDEPENDS:${PN}:class-target += " \
|
|
python3-codecs \
|
|
python3-logging \
|
|
python3-math \
|
|
python3-shell \
|
|
"
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|
|
|
|
inherit ptest
|
|
|
|
SRC_URI += " \
|
|
file://run-ptest \
|
|
file://CVE-2026-23490.patch \
|
|
file://CVE-2026-59886.patch \
|
|
"
|
|
|
|
RDEPENDS:${PN}-ptest += " \
|
|
python3-pytest \
|
|
python3-unittest-automake-output \
|
|
"
|
|
|
|
do_install_ptest() {
|
|
install -d ${D}${PTEST_PATH}/tests
|
|
cp -rf ${S}/tests/* ${D}${PTEST_PATH}/tests/
|
|
}
|