Files
poky/meta/recipes-devtools/python
Emily Vekariya d78b160b6c python3-pyasn1: Fix CVE-2026-59884
The BER decoder shared by the CER and DER codecs parses long-form tags by
accumulating continuation octets without an upper bound on the tag ID size.
A crafted input can force construction of an arbitrarily large integer with
CPU cost growing quadratically, and can trigger unhandled ValueError
exceptions in the Python 3.11+ error formatting paths. Any application
decoding untrusted BER, CER, or DER input is affected.

scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.

Pick the upstream patch [1] as mentioned in [2].

[1] 628e36ecbb
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59884

(From OE-Core rev: 75ff4b187cf1b5e4e874cab8273ea84377b3c873)

Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2026-09-04 10:39:10 +01:00
..
2026-08-24 11:43:45 +01:00
2023-05-11 17:08:29 +01:00
2026-08-24 11:43:45 +01:00
2024-11-09 05:53:57 -08:00
2024-02-20 11:39:45 +00:00
2024-02-20 11:39:45 +00:00
2024-02-20 11:39:45 +00:00
2024-02-20 11:39:45 +00:00