[ubuntu/noble-security] pyasn1 0.4.8-4ubuntu0.3 (Accepted)

[Marc Deslauriers]

pyasn1 (0.4.8-4ubuntu0.3) noble-security; urgency=medium

  * SECURITY UPDATE: pyasn1 BER/CER/DER decoder denial of service via
    unbounded long-form tag IDs 
    - debian/patches/CVE-2026-59886.patch: Merge commit from fork in
      pyasn1/type/univ.py, tests/codec/ber/test_decoder.py,
      tests/codec/cer/test_decoder.py, tests/codec/der/test_decoder.py,
      tests/type/test_univ.py.
    - CVE-2026-59886
  * SECURITY UPDATE: Quadratic complexity in OBJECT IDENTIFIER and
    RELATIVE-OID processing allows denial of service
    - debian/patches/CVE-2026-59884.patch: Merge commit from fork in
      pyasn1/codec/ber/decoder.py, pyasn1/type/tag.py,
      tests/codec/ber/test_decoder.py, tests/codec/cer/test_decoder.py,
      tests/codec/der/test_decoder.py, tests/type/test_tag.py.
    - CVE-2026-59884
  * SECURITY UPDATE: Uncontrolled resource consumption when converting
    decoded REAL values
    - debian/patches/CVE-2026-59885.patch: Merge commit from fork in
      pyasn1/codec/ber/decoder.py, pyasn1/codec/ber/encoder.py,
      tests/codec/ber/test_decoder.py, tests/codec/ber/test_encoder.py.
    - CVE-2026-59885

Date: 2026-08-21 14:12:20.093051+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/pyasn1/0.4.8-4ubuntu0.3
-------------- next part --------------
Sorry, changesfile not available.