Re: [OE-core] [scarthgap][PATCH 09/12] python3-pyasn1: fix CVE-2026-30922

["Yoann Congal" <yoann.congal@smile.fr>]

On Thu Apr 9, 2026 at 8:16 AM CEST, Jinfeng (CN) via lists.openembedded.org Wang wrote:
> From: Jiaying Song <jiaying.song.cn@windriver.com>
>
> pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the
> `pyasn1` library is vulnerable to a Denial of Service (DoS) attack
> caused by uncontrolled recursion when decoding ASN.1 data with deeply
> nested structures. An attacker can supply a crafted payload containing
> thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with
> "Indefinite Length" (`0x80`) markers. This forces the decoder to
> recursively call itself until the Python interpreter crashes with a
> `RecursionError` or consumes all available memory (OOM), crashing the
> host application. This is a distinct vulnerability from CVE-2026-23490
> (which addressed integer overflows in OID decoding). The fix for
> CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate
> this recursion issue. Version 0.6.3 fixes this specific issue.
>
> References:
> https://nvd.nist.gov/vuln/detail/CVE-2026-30922
>
> Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
> Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
> ---

AFAIK, this CVE also apply to master (I'm not sure why it does not
appear on https://valkyrie.yocto.io/pub/non-release/patchmetrics/)

I'll hold this patch until "python3-pyasn1: upgrade 0.6.2 -> 0.6.3"
merges.

>  .../recipes-devtools/python/python-pyasn1.inc |   1 +
>  .../python3-pyasn1/CVE-2026-30922.patch       | 257 ++++++++++++++++++
>  2 files changed, 258 insertions(+)
>  create mode 100644 meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
>
> diff --git a/meta/recipes-devtools/python/python-pyasn1.inc b/meta/recipes-devtools/python/python-pyasn1.inc
> index 96b4a3b52a..d69cdf8877 100644
> --- a/meta/recipes-devtools/python/python-pyasn1.inc
> +++ b/meta/recipes-devtools/python/python-pyasn1.inc
> @@ -19,6 +19,7 @@ inherit ptest
>  SRC_URI += " \
>         file://run-ptest \
>         file://CVE-2026-23490.patch \
> +       file://CVE-2026-30922.patch \
>  "
>  
>  RDEPENDS:${PN}-ptest += " \
> diff --git a/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch b/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
> new file mode 100644
> index 0000000000..7eceaa2595
> --- /dev/null
> +++ b/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
> @@ -0,0 +1,257 @@
> +From 85e901d1dacdcd17363cc2dd18a91cfb72363eeb Mon Sep 17 00:00:00 2001
> +From: Simon Pichugin <simon.pichugin@gmail.com>
> +Date: Thu, 19 Mar 2026 17:11:40 +0800
> +Subject: [PATCH] Merge commit from fork
> +
> +CVE: CVE-2026-30922
> +
> +Upstream-Status: Backport [https://github.com/pyasn1/pyasn1/commit/25ad481c19]
> +
> +Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
> +---
> + pyasn1/codec/ber/decoder.py     |  10 +++
> + tests/codec/ber/test_decoder.py | 114 ++++++++++++++++++++++++++++++++
> + tests/codec/cer/test_decoder.py |  22 ++++++
> + tests/codec/der/test_decoder.py |  40 +++++++++++
> + 4 files changed, 186 insertions(+)
> +
> +diff --git a/pyasn1/codec/ber/decoder.py b/pyasn1/codec/ber/decoder.py
> +index be8ba65..da2a048 100644
> +--- a/pyasn1/codec/ber/decoder.py
> ++++ b/pyasn1/codec/ber/decoder.py
> +@@ -38,6 +38,7 @@ SubstrateUnderrunError = error.SubstrateUnderrunError
> + # Maximum number of continuation octets (high-bit set) allowed per OID arc.
> + # 20 octets allows up to 140-bit integers, supporting UUID-based OIDs
> + MAX_OID_ARC_CONTINUATION_OCTETS = 20
> ++MAX_NESTING_DEPTH = 100
> + 
> + 
> + class AbstractPayloadDecoder(object):
> +@@ -1515,6 +1516,15 @@ class SingleItemDecoder(object):
> +                  decodeFun=None, substrateFun=None,
> +                  **options):
> + 
> ++        _nestingLevel = options.get('_nestingLevel', 0)
> ++
> ++        if _nestingLevel > MAX_NESTING_DEPTH:
> ++            raise error.PyAsn1Error(
> ++                'ASN.1 structure nesting depth exceeds limit (%d)' % MAX_NESTING_DEPTH
> ++            )
> ++
> ++        options['_nestingLevel'] = _nestingLevel + 1
> ++
> +         allowEoo = options.pop('allowEoo', False)
> + 
> +         if LOG:
> +diff --git a/tests/codec/ber/test_decoder.py b/tests/codec/ber/test_decoder.py
> +index f033dfd..226381a 100644
> +--- a/tests/codec/ber/test_decoder.py
> ++++ b/tests/codec/ber/test_decoder.py
> +@@ -1987,6 +1987,120 @@ class CompressedFilesTestCase(BaseTestCase):
> +         finally:
> +             os.remove(path)
> + 
> ++class NestingDepthLimitTestCase(BaseTestCase):
> ++    """Test protection against deeply nested ASN.1 structures (CVE prevention)."""
> ++
> ++    def testIndefLenSequenceNesting(self):
> ++        """Deeply nested indefinite-length SEQUENCEs must raise PyAsn1Error."""
> ++        # Each \x30\x80 opens a new indefinite-length SEQUENCE
> ++        payload = b'\x30\x80' * 200
> ++        try:
> ++            decoder.decode(payload)
> ++        except error.PyAsn1Error:
> ++            pass
> ++        else:
> ++            assert False, 'Deeply nested indef-length SEQUENCEs not rejected'
> ++
> ++    def testIndefLenSetNesting(self):
> ++        """Deeply nested indefinite-length SETs must raise PyAsn1Error."""
> ++        # Each \x31\x80 opens a new indefinite-length SET
> ++        payload = b'\x31\x80' * 200
> ++        try:
> ++            decoder.decode(payload)
> ++        except error.PyAsn1Error:
> ++            pass
> ++        else:
> ++            assert False, 'Deeply nested indef-length SETs not rejected'
> ++
> ++    def testDefiniteLenNesting(self):
> ++        """Deeply nested definite-length SEQUENCEs must raise PyAsn1Error."""
> ++        inner = b'\x05\x00'  # NULL
> ++        for _ in range(200):
> ++            length = len(inner)
> ++            if length < 128:
> ++                inner = b'\x30' + bytes([length]) + inner
> ++            else:
> ++                length_bytes = length.to_bytes(
> ++                    (length.bit_length() + 7) // 8, 'big')
> ++                inner = b'\x30' + bytes([0x80 | len(length_bytes)]) + \
> ++                    length_bytes + inner
> ++        try:
> ++            decoder.decode(inner)
> ++        except error.PyAsn1Error:
> ++            pass
> ++        else:
> ++            assert False, 'Deeply nested definite-length SEQUENCEs not rejected'
> ++
> ++    def testNestingUnderLimitWorks(self):
> ++        """Nesting within the limit must decode successfully."""
> ++        inner = b'\x05\x00'  # NULL
> ++        for _ in range(50):
> ++            length = len(inner)
> ++            if length < 128:
> ++                inner = b'\x30' + bytes([length]) + inner
> ++            else:
> ++                length_bytes = length.to_bytes(
> ++                    (length.bit_length() + 7) // 8, 'big')
> ++                inner = b'\x30' + bytes([0x80 | len(length_bytes)]) + \
> ++                    length_bytes + inner
> ++        asn1Object, _ = decoder.decode(inner)
> ++        assert asn1Object is not None, 'Valid nested structure rejected'
> ++
> ++    def testSiblingsDontIncreaseDepth(self):
> ++        """Sibling elements at the same level must not inflate depth count."""
> ++        # SEQUENCE containing 200 INTEGER siblings - should decode fine
> ++        components = b'\x02\x01\x01' * 200  # 200 x INTEGER(1)
> ++        length = len(components)
> ++        length_bytes = length.to_bytes(
> ++            (length.bit_length() + 7) // 8, 'big')
> ++        payload = b'\x30' + bytes([0x80 | len(length_bytes)]) + \
> ++            length_bytes + components
> ++        asn1Object, _ = decoder.decode(payload)
> ++        assert asn1Object is not None, 'Siblings incorrectly rejected'
> ++
> ++    def testErrorMessageContainsLimit(self):
> ++        """Error message must indicate the nesting depth limit."""
> ++        payload = b'\x30\x80' * 200
> ++        try:
> ++            decoder.decode(payload)
> ++        except error.PyAsn1Error as exc:
> ++            assert 'nesting depth' in str(exc).lower(), \
> ++                'Error message missing depth info: %s' % exc
> ++        else:
> ++            assert False, 'Expected PyAsn1Error'
> ++
> ++    def testNoRecursionError(self):
> ++        """Must raise PyAsn1Error, not RecursionError."""
> ++        payload = b'\x30\x80' * 50000
> ++        try:
> ++            decoder.decode(payload)
> ++        except error.PyAsn1Error:
> ++            pass
> ++        except RecursionError:
> ++            assert False, 'Got RecursionError instead of PyAsn1Error'
> ++
> ++    def testMixedNesting(self):
> ++        """Mixed SEQUENCE and SET nesting must be caught."""
> ++        # Alternate SEQUENCE (0x30) and SET (0x31) with indef length
> ++        payload = b''
> ++        for i in range(200):
> ++            payload += b'\x30\x80' if i % 2 == 0 else b'\x31\x80'
> ++        try:
> ++            decoder.decode(payload)
> ++        except error.PyAsn1Error:
> ++            pass
> ++        else:
> ++            assert False, 'Mixed nesting not rejected'
> ++
> ++    def testWithSchema(self):
> ++        """Deeply nested structures must be caught even with schema."""
> ++        payload = b'\x30\x80' * 200
> ++        try:
> ++            decoder.decode(payload, asn1Spec=univ.Sequence())
> ++        except error.PyAsn1Error:
> ++            pass
> ++        else:
> ++            assert False, 'Deeply nested with schema not rejected'
> + 
> + class NonStreamingCompatibilityTestCase(BaseTestCase):
> +     def setUp(self):
> +diff --git a/tests/codec/cer/test_decoder.py b/tests/codec/cer/test_decoder.py
> +index 133affd..fbb1145 100644
> +--- a/tests/codec/cer/test_decoder.py
> ++++ b/tests/codec/cer/test_decoder.py
> +@@ -363,6 +363,28 @@ class SequenceDecoderWithExplicitlyTaggedSetOfOpenTypesTestCase(BaseTestCase):
> +         assert s[0] == 3
> +         assert s[1][0] == univ.OctetString(hexValue='02010C')
> + 
> ++class NestingDepthLimitTestCase(BaseTestCase):
> ++    """Test CER decoder protection against deeply nested structures."""
> ++
> ++    def testIndefLenNesting(self):
> ++        """Deeply nested indefinite-length SEQUENCEs must raise PyAsn1Error."""
> ++        payload = b'\x30\x80' * 200
> ++        try:
> ++            decoder.decode(payload)
> ++        except PyAsn1Error:
> ++            pass
> ++        else:
> ++            assert False, 'Deeply nested indef-length SEQUENCEs not rejected'
> ++
> ++    def testNoRecursionError(self):
> ++        """Must raise PyAsn1Error, not RecursionError."""
> ++        payload = b'\x30\x80' * 50000
> ++        try:
> ++            decoder.decode(payload)
> ++        except PyAsn1Error:
> ++            pass
> ++        except RecursionError:
> ++            assert False, 'Got RecursionError instead of PyAsn1Error'
> + 
> + suite = unittest.TestLoader().loadTestsFromModule(sys.modules[__name__])
> + 
> +diff --git a/tests/codec/der/test_decoder.py b/tests/codec/der/test_decoder.py
> +index 5bc9deb..b0fa867 100644
> +--- a/tests/codec/der/test_decoder.py
> ++++ b/tests/codec/der/test_decoder.py
> +@@ -361,6 +361,46 @@ class SequenceDecoderWithExplicitlyTaggedSetOfOpenTypesTestCase(BaseTestCase):
> +         assert s[0] == 3
> +         assert s[1][0] == univ.OctetString(hexValue='02010C')
> + 
> ++class NestingDepthLimitTestCase(BaseTestCase):
> ++    """Test DER decoder protection against deeply nested structures."""
> ++
> ++    def testDefiniteLenNesting(self):
> ++        """Deeply nested definite-length SEQUENCEs must raise PyAsn1Error."""
> ++        inner = b'\x05\x00'  # NULL
> ++        for _ in range(200):
> ++            length = len(inner)
> ++            if length < 128:
> ++                inner = b'\x30' + bytes([length]) + inner
> ++            else:
> ++                length_bytes = length.to_bytes(
> ++                    (length.bit_length() + 7) // 8, 'big')
> ++                inner = b'\x30' + bytes([0x80 | len(length_bytes)]) + \
> ++                    length_bytes + inner
> ++        try:
> ++            decoder.decode(inner)
> ++        except PyAsn1Error:
> ++            pass
> ++        else:
> ++            assert False, 'Deeply nested definite-length SEQUENCEs not rejected'
> ++
> ++    def testNoRecursionError(self):
> ++        """Must raise PyAsn1Error, not RecursionError."""
> ++        inner = b'\x05\x00'
> ++        for _ in range(200):
> ++            length = len(inner)
> ++            if length < 128:
> ++                inner = b'\x30' + bytes([length]) + inner
> ++            else:
> ++                length_bytes = length.to_bytes(
> ++                    (length.bit_length() + 7) // 8, 'big')
> ++                inner = b'\x30' + bytes([0x80 | len(length_bytes)]) + \
> ++                    length_bytes + inner
> ++        try:
> ++            decoder.decode(inner)
> ++        except PyAsn1Error:
> ++            pass
> ++        except RecursionError:
> ++            assert False, 'Got RecursionError instead of PyAsn1Error'
> + 
> + suite = unittest.TestLoader().loadTestsFromModule(sys.modules[__name__])
> + 
> +-- 
> +2.34.1
> +


-- 
Yoann Congal
Smile ECS