rpms/python-pyasn1
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

base: rpms:imports/c10s/python-pyasn1-0.6.4-1.el10
Branches Tags
rpms:c8
rpms:c9s
rpms:c10s
rpms:c10
rpms:c9
rpms:c8s
rpms:c9-beta
rpms:c8-beta
rpms:imports/c10s/python-pyasn1-0.6.4-1.el10
rpms:imports/c10s/python-pyasn1-0.6.3-1.el10
rpms:imports/c8/python-pyasn1-0.3.7-6.el8_10.1
rpms:imports/c10/python-pyasn1-0.6.2-1.el10_1
rpms:imports/c9/python-pyasn1-0.4.8-7.el9_7
rpms:imports/c10s/python-pyasn1-0.6.2-1.el10
rpms:imports/c10/python-pyasn1-0.6.1-1.el10_0
rpms:imports/c10s/python-pyasn1-0.6.1-1.el10
rpms:imports/c10s/python-pyasn1-0.5.1-5.el10
rpms:imports/c10s/python-pyasn1-0.5.1-4.el10
rpms:imports/c8s/python-pyasn1-0.3.7-6.el8
rpms:imports/c9/python-pyasn1-0.4.8-6.el9
rpms:imports/c9-beta/python-pyasn1-0.4.8-6.el9
rpms:imports/c8-beta/python-pyasn1-0.3.7-6.el8
rpms:imports/c8/python-pyasn1-0.3.7-6.el8
...
compare: rpms:c8
Branches Tags
rpms:c9s
rpms:c10s
rpms:c8
rpms:c10
rpms:c9
rpms:c8s
rpms:c9-beta
rpms:c8-beta
rpms:imports/c10s/python-pyasn1-0.6.4-1.el10
rpms:imports/c10s/python-pyasn1-0.6.3-1.el10
rpms:imports/c8/python-pyasn1-0.3.7-6.el8_10.1
rpms:imports/c10/python-pyasn1-0.6.2-1.el10_1
rpms:imports/c9/python-pyasn1-0.4.8-7.el9_7
rpms:imports/c10s/python-pyasn1-0.6.2-1.el10
rpms:imports/c10/python-pyasn1-0.6.1-1.el10_0
rpms:imports/c10s/python-pyasn1-0.6.1-1.el10
rpms:imports/c10s/python-pyasn1-0.5.1-5.el10
rpms:imports/c10s/python-pyasn1-0.5.1-4.el10
rpms:imports/c8s/python-pyasn1-0.3.7-6.el8
rpms:imports/c9/python-pyasn1-0.4.8-6.el9
rpms:imports/c9-beta/python-pyasn1-0.4.8-6.el9
rpms:imports/c8-beta/python-pyasn1-0.3.7-6.el8
rpms:imports/c8/python-pyasn1-0.3.7-6.el8

No commits in common. "imports/c10s/python-pyasn1-0.6.4-1.el10" and "c8" have entirely different histories.
imports/c1 ... c8

7 changed files with 156 additions and 186 deletions
Show Stats Expand all files Collapse all files

5
.gitignore vendored
View File

@ -1,3 +1,2 @@
/pyasn1-*.tar.gz
/pyasn1-modules-*.tar.gz
/v*.tar.gz
SOURCES/v0.1.5.tar.gz
SOURCES/v0.3.7.tar.gz

2
.python-pyasn1.metadata Normal file
View File

@ -0,0 +1,2 @@
056d811a9a6a3a672fdeb3dd09bb17bc30968997 SOURCES/v0.1.5.tar.gz
a38478ac81d5b88caee1d92ce14185f34303890b SOURCES/v0.3.7.tar.gz

122
SOURCES/0001-Backport-commit-be353d7.patch Normal file
View File

@ -0,0 +1,122 @@
From b111e63bd3b86ca9747b1bbb3f7eae7b9c01a82e Mon Sep 17 00:00:00 2001
From: Masahiro Matsuya <mmatsuya@redhat.com>
Date: Wed, 18 Feb 2026 13:54:42 +0900
Subject: [PATCH] Backport commit be353d7
Add limit of 20 continuation octets per OID arc to prevent a potential memory
exhaustion from excessive continuation bytes input.
---
pyasn1/codec/ber/decoder.py | 11 ++++++
tests/codec/ber/test_decoder.py | 66 +++++++++++++++++++++++++++++++++
2 files changed, 77 insertions(+)
diff --git a/pyasn1/codec/ber/decoder.py b/pyasn1/codec/ber/decoder.py
index ee3064f..69c9ecd 100644
--- a/pyasn1/codec/ber/decoder.py
+++ b/pyasn1/codec/ber/decoder.py
@@ -14,6 +14,10 @@ __all__ = ['decode']
noValue = base.noValue
+# Maximum number of continuation octets (high-bit set) allowed per OID arc.
+# 20 octets allows up to 140-bit integers, supporting UUID-based OIDs
+MAX_OID_ARC_CONTINUATION_OCTETS = 20
+
class AbstractDecoder(object):
protoComponent = None
@@ -284,7 +288,14 @@ class ObjectIdentifierDecoder(AbstractSimpleDecoder):
# Construct subid from a number of octets
nextSubId = subId
subId = 0
+ continuationOctetCount = 0
while nextSubId >= 128:
+ continuationOctetCount += 1
+ if continuationOctetCount > MAX_OID_ARC_CONTINUATION_OCTETS:
+ raise error.PyAsn1Error(
+ 'OID arc exceeds maximum continuation octets limit (%d) '
+ 'at position %d' % (MAX_OID_ARC_CONTINUATION_OCTETS, index)
+ )
subId = (subId << 7) + (nextSubId & 0x7F)
if index >= substrateLen:
raise error.SubstrateUnderrunError(
diff --git a/tests/codec/ber/test_decoder.py b/tests/codec/ber/test_decoder.py
index 5ec3a5f..ba7dfec 100644
--- a/tests/codec/ber/test_decoder.py
+++ b/tests/codec/ber/test_decoder.py
@@ -403,6 +403,72 @@ class ObjectIdentifierDecoderTestCase(BaseTestCase):
0xB8, 0xCB, 0xE2, 0xB6, 0x47))
) == ((2, 999, 18446744073709551535184467440737095), null)
+ def testExcessiveContinuationOctets(self):
+ """Test that OID arcs with excessive continuation octets are rejected."""
+ # Create a payload with 25 continuation octets (exceeds 20 limit)
+ # 0x81 bytes are continuation octets, 0x01 terminates
+ malicious_payload = bytes([0x06, 26]) + bytes([0x81] * 25) + bytes([0x01])
+ try:
+ decoder.decode(malicious_payload)
+ except PyAsn1Error:
+ pass
+ else:
+ assert 0, 'Excessive continuation octets tolerated'
+
+ def testMaxAllowedContinuationOctets(self):
+ """Test that OID arcs at the maximum continuation octets limit work."""
+ # Create a payload with exactly 20 continuation octets (at limit)
+ # This should succeed
+ payload = bytes([0x06, 21]) + bytes([0x81] * 20) + bytes([0x01])
+ try:
+ decoder.decode(payload)
+ except PyAsn1Error:
+ assert 0, 'Valid OID with 20 continuation octets rejected'
+
+ def testOneOverContinuationLimit(self):
+ """Test boundary: 21 continuation octets (one over limit) is rejected."""
+ payload = bytes([0x06, 22]) + bytes([0x81] * 21) + bytes([0x01])
+ try:
+ decoder.decode(payload)
+ except PyAsn1Error:
+ pass
+ else:
+ assert 0, '21 continuation octets tolerated (should be rejected)'
+
+ def testExcessiveContinuationInSecondArc(self):
+ """Test that limit applies to subsequent arcs, not just the first."""
+ # First arc: valid simple byte (0x55 = 85, decodes to arc 2.5)
+ # Second arc: excessive continuation octets
+ payload = bytes([0x06, 27]) + bytes([0x55]) + bytes([0x81] * 25) + bytes([0x01])
+ try:
+ decoder.decode(payload)
+ except PyAsn1Error:
+ pass
+ else:
+ assert 0, 'Excessive continuation in second arc tolerated'
+
+ def testMultipleArcsAtLimit(self):
+ """Test multiple arcs each at the continuation limit work correctly."""
+ # Two arcs, each with 20 continuation octets (both at limit)
+ arc1 = bytes([0x81] * 20) + bytes([0x01]) # 21 bytes
+ arc2 = bytes([0x81] * 20) + bytes([0x01]) # 21 bytes
+ payload = bytes([0x06, 42]) + arc1 + arc2
+ try:
+ decoder.decode(payload)
+ except PyAsn1Error:
+ assert 0, 'Multiple valid arcs at limit rejected'
+
+ def testExcessiveContinuationWithMaxBytes(self):
+ """Test with 0xFF continuation bytes (maximum value, not just 0x81)."""
+ # 0xFF bytes are also continuation octets (high bit set)
+ malicious_payload = bytes([0x06, 26]) + bytes([0xFF] * 25) + bytes([0x01])
+ try:
+ decoder.decode(malicious_payload)
+ except PyAsn1Error:
+ pass
+ else:
+ assert 0, 'Excessive 0xFF continuation octets tolerated'
+
class RealDecoderTestCase(BaseTestCase):
def testChar(self):
--
2.52.0

177
python-pyasn1.spec → SPECS/python-pyasn1.spec
View File

@ -1,16 +1,20 @@
%global module pyasn1
%global modules_version 0.4.2
%global modules_version 0.1.5
Name: python-pyasn1
Version: 0.6.4
Release: 1%{?dist}
Version: 0.3.7
Release: 6%{?dist}.1
Summary: ASN.1 tools for Python
License: BSD-2-Clause
Source0: https://github.com/pyasn1/pyasn1/archive/v%{version}.tar.gz
Source1: https://github.com/pyasn1/pyasn1-modules/archive/v%{modules_version}.tar.gz
URL: https://github.com/pyasn1/pyasn1
License: BSD
Group: System Environment/Libraries
Source0: https://github.com/etingof/pyasn1/archive/v%{version}.tar.gz
Source1: https://github.com/etingof/pyasn1-modules/archive/v%{modules_version}.tar.gz
URL: http://pyasn1.sourceforge.net/
BuildArch: noarch
Patch1: 0001-Backport-commit-be353d7.patch
%description
This is an implementation of ASN.1 types and codecs in the Python programming
language.
@ -20,7 +24,6 @@ Summary: ASN.1 tools for Python 3
%{?python_provide:%python_provide python3-pyasn1}
BuildRequires: python3-devel
BuildRequires: python3-setuptools
BuildRequires: python3-pytest
%description -n python3-pyasn1
This is an implementation of ASN.1 types and codecs in the Python 3 programming
@ -28,15 +31,14 @@ language.
%package -n python3-pyasn1-modules
Summary: Modules for pyasn1
Requires: python3-pyasn1 >= %{version}-%{release}
%{?python_provide:%python_provide python3-modules}
Requires: python3-pyasn1 >= 0.4.7, python3-pyasn1 < 0.7.0
%description -n python3-pyasn1-modules
ASN.1 types modules for python3-pyasn1.
%package doc
Summary: Documentation for pyasn1
BuildRequires: make
BuildRequires: python3-sphinx
%description doc
@ -45,174 +47,55 @@ BuildRequires: python3-sphinx
%prep
%setup -n %{module}-%{version} -q -b1
%generate_buildrequires
%pyproject_buildrequires
%autopatch -p1
%build
%pyproject_wheel
%py3_build
pushd ../pyasn1-modules-%{modules_version}
%pyproject_wheel
%py3_build
popd
pushd docs
pushd doc
PYTHONPATH=%{buildroot}%{python3_sitelib} make SPHINXBUILD=sphinx-build-3 html
popd
%install
%pyproject_install
%py3_install
pushd ../pyasn1-modules-%{modules_version}
%py3_install
popd
%check
%pytest
PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} setup.py test
%files -n python3-pyasn1
%doc README.md
%license LICENSE.rst
%{python3_sitelib}/%{module}
%{python3_sitelib}/%{module}-%{version}.dist-info/
%{python3_sitelib}/%{module}-%{version}-*.egg-info/
%files -n python3-pyasn1-modules
%{python3_sitelib}/%{module}_modules/
%{python3_sitelib}/%{module}_modules-%{modules_version}.dist-info/
%{python3_sitelib}/%{module}_modules-%{modules_version}-*.egg-info/
%files doc
%license LICENSE.rst
%doc docs/build/html/*
%doc doc/build/html/*
%changelog
* Thu Jul 16 2026 Simon Pichugin <spichugi@redhat.com> - 0.6.4-1
- Update to 0.6.4
- Fixed quadratic complexity in OID/RELATIVE-OID decoders (CVE-2026-59885)
- Limited BER/CER/DER long-form tag IDs to 20 octets (CVE-2026-59884)
- Fixed excessive resource use in Real.__float__() (CVE-2026-59886)
- Resolves: RHEL-211094
* Wed Feb 18 2026 Masahiro Matsuya <mmatsuya@redhat.com> - 0.3.7-6.el8_10.1
- Resolves: RHEL-148145
* Fri Apr 24 2026 Simon Pichugin <spichugi@redhat.com> - 0.6.3-1
- Update to 0.6.3
- Added nesting depth limit to ASN.1 decoder (CVE-2026-30922)
- Resolves: RHEL-170609
* Mon Jul 09 2018 Petr Viktorin <pviktori@redhat.com> - 0.3.7-6
- Remove the python2 subpackage
* Wed Feb 11 2026 Florence Blanc-Renaud <flo@redhat.com> - 0.6.2-1
- Update to 0.6.2
- Update modules to 0.4.2
Resolves: RHEL-148142
* Fri Nov 15 2024 Simon Pichugin <spichugi@redhat.com> - 0.6.1-1
- Update to 0.6.1
- Update modules to 0.4.1
Resolves: RHEL-67667
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 0.5.1-5
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018
* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 0.5.1-4
- Bump release for June 2024 mass rebuild
* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 0.5.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 0.5.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Mon Nov 27 2023 Simon Pichugin <spichugi@redhat.com> - 0.5.1-1
- Update to 0.5.1
- Update modules to 0.3.0
* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.8-16
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Tue Jun 27 2023 Stephen Gallagher <sgallagh@redhat.com> - 0.4.8-15
- Rebuild for Python 3.12
* Wed Jun 14 2023 Python Maint <python-maint@redhat.com> - 0.4.8-14
- Rebuilt for Python 3.12
* Thu Feb 23 2023 Rob Crittenden <rcritten@redhat.com> - 0.4.8-13
- migrated to SPDX license
- correct bad date in changelog
* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.8-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.8-11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 0.4.8-10
- Rebuilt for Python 3.11
* Mon Mar 1 2021 Rob Crittenden <rcritten@redhat.com> - 0.4.8-9
- Set URL to https://github.com/etingof/pyasn1 in the spec file (#2059715)
* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.8-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
* Tue Jul 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.8-7
- Second attempt - Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Wed Jul 07 2021 Rob Crittenden <rcritten@redhat.com> - 0.4.8-6
- Follow upstream requirements.txt for modules -> pyasn1 (#1979875)
* Thu Jun 03 2021 Python Maint <python-maint@redhat.com> - 0.4.8-5
- Rebuilt for Python 3.10
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.8-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.8-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Sat May 23 2020 Miro Hrončok <mhroncok@redhat.com> - 0.4.8-2
- Rebuilt for Python 3.9
* Thu Jan 30 2020 Rob Crittenden <rcritten@redhat.com> - 0.4.8-1
- Update to 0.4.8 (#1747820)
- Update modules to 0.2.8
* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.6-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Wed Oct 23 2019 Rob Crittenden <rcritten@redhat.com> - 0.4.6-3
- Remove python2 subpackages (#1764573)
* Thu Oct 03 2019 Miro Hrončok <mhroncok@redhat.com> - 0.4.6-2
- Rebuilt for Python 3.8.0rc1 (#1748018)
* Fri Aug 30 2019 Rob Crittenden <rcritten@redhat.com> - 0.4.6-1
- Update to 0.4.6 (#1742424)
- Update modules to 0.2.6
* Fri Aug 16 2019 Miro Hrončok <mhroncok@redhat.com> - 0.4.4-6
- Rebuilt for Python 3.8
* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.4-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.4-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Tue Oct 16 2018 Rob Crittenden <rcritten@redhat.com> - 0.4.4-3
- Restore python2 subpackages
* Mon Oct 15 2018 Rob Crittenden <rcritten@redhat.com> - 0.4.4-2
- Add back accidentally removed buildrequires
* Mon Oct 15 2018 Rob Crittenden <rcritten@redhat.com> - 0.4.4-1
- Update to 0.4.4 (#1582010)
- Update modules to 0.2.2
- Drop python 2 subpackages
* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org>
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Tue Jun 19 2018 Miro Hrončok <mhroncok@redhat.com> - 0.3.7-5
* Sun Jun 17 2018 Miro Hrončok <mhroncok@redhat.com> - 0.3.7-5
- Use Python 3 Sphinx if with Python 3
- Cleanup

7
gating.yaml
View File

@ -1,7 +0,0 @@
# recipients: abokovoy, frenaud, kaleem, ftrivino, cheimes
--- !Policy
product_versions:
- rhel-10
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

2
sources
View File

@ -1,2 +0,0 @@
SHA512 (v0.4.2.tar.gz) = 7c4feab23a8c5ab72549387586894d1d53a3ad8b9d12cc5774b1d1f5192873f87da2e3525059fdda5b5884a52908ce79df274e3b75ee1f42af32e83ceb3f9167
SHA512 (v0.6.4.tar.gz) = ce04b28d42d41fc8fa20608b773bf6691b46427f73f3fc3fb1a81c06996133bd77dcb2b4f6ba8213e27222d4203adc90adf64eeb7096ec82bc7df6e2f307657d

27
tests/tests.yml
View File

@ -1,27 +0,0 @@
---
- hosts: localhost
tags:
- classic
pre_tasks:
- import_role:
name: standard-test-source
vars:
flatten: false
roles:
- role: standard-test-basic
required_packages:
- python3-pyasn1
- python3-pyasn1-modules
- python3-pytest
tests:
- unittests-pyasn1:
dir: "source/pyasn1-0.6.4"
run: >-
rm -rf pyasn1* &&
pytest-3 tests/
- unittests-pyasn1-modules:
dir: "source/pyasn1-modules-0.4.2"
run: >-
rm -rf pyasn1_modules* &&
pytest-3 tests/