Add the missing import to the cer and der test_decoder.py sections
of python-pyasn1-0.3.7-CVE-2026-59886.patch. The new tests use
univ.Real() but the import line was not added along with the
encoder import, causing NameError at test time.
Signed-off-by: Masahiro Matsuya <mmatsuya@redhat.com>
Backport upstream commit 90d5e17 to fix CVE-2026-59886, a denial
of service vulnerability in the Real type's __float__() method.
The flaw allowed astronomically large integer materialization
via pow(). The patch rewrites __float__() to use math.ldexp()
for base-2 values, adds overflow protection for base-10 values,
fixes integer division in __normalizeBase10(), and handles zero
mantissa early. Comprehensive tests are added for BER, CER, DER
decoders and the Real type unit tests.
CVE: CVE-2026-59886
Upstream patches:
- 90d5e17239.patch
Resolves: RHEL-217908
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
