Re: [OE-core][scarthgap][PATCH 1/2] python3-pyasn1: fix CVE-2026-30922

["Yoann Congal" <yoann.congal@smile.fr>]

On Thu Aug 27, 2026 at 8:31 AM CEST, Yogita Urade -X (yurade - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> This patch applies upstream fix for CVE-2026-30922 as referenced in [2],
> using the upstream commit identified in [1].
>
> [1] https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0
> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-30922
>
> Signed-off-by: Yogita Urade <yurade@cisco.com>
> ---
>  .../recipes-devtools/python/python-pyasn1.inc |   1 +
>  .../python3-pyasn1/CVE-2026-30922.patch       | 260 ++++++++++++++++++
>  2 files changed, 261 insertions(+)
>  create mode 100644 meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
>
> diff --git a/meta/recipes-devtools/python/python-pyasn1.inc b/meta/recipes-devtools/python/python-pyasn1.inc
> index 96b4a3b52a..d69cdf8877 100644
> --- a/meta/recipes-devtools/python/python-pyasn1.inc
> +++ b/meta/recipes-devtools/python/python-pyasn1.inc
> @@ -19,6 +19,7 @@ inherit ptest
>  SRC_URI += " \
>         file://run-ptest \
>         file://CVE-2026-23490.patch \
> +       file://CVE-2026-30922.patch \
>  "
>  
>  RDEPENDS:${PN}-ptest += " \
> diff --git a/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch b/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
> new file mode 100644
> index 0000000000..aad4829f82
> --- /dev/null
> +++ b/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
> @@ -0,0 +1,260 @@
> +From b10f9a671c66a99b91bd916e62a0c81541094dd6 Mon Sep 17 00:00:00 2001
> +From: Simon Pichugin <simon.pichugin@gmail.com>
> +Date: Mon, 16 Mar 2026 17:23:11 -0700
> +Subject: [PATCH] Merge commit from fork
> +
> +CVE: CVE-2026-30922
> +Upstream-Status: Backport [https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0]
> +
> +(cherry picked from commit 25ad481c19fdb006e20485ef3fc2e5b3eff30ef0)
> +Signed-off-by: Yogita Urade <yurade@cisco.com>
> +---
> + pyasn1/codec/ber/decoder.py     |  10 +++
> + tests/codec/ber/test_decoder.py | 116 ++++++++++++++++++++++++++++++++
> + tests/codec/cer/test_decoder.py |  24 +++++++
> + tests/codec/der/test_decoder.py |  42 ++++++++++++
> + 4 files changed, 192 insertions(+)

Hello,

Thanks for the patch but it does not apply cleanly (surely a conflict
with the other recent CVE fixes):
    ERROR: python3-pyasn1-0.5.1-r0 do_patch: QA Issue: Fuzz detected:

    Applying patch CVE-2026-30922.patch
    patching file pyasn1/codec/ber/decoder.py
    Hunk #1 succeeded at 38 with fuzz 2.
    Hunk #2 succeeded at 1520 (offset 4 lines).
    patching file tests/codec/ber/test_decoder.py
    Hunk #1 succeeded at 2048 (offset 60 lines).
    patching file tests/codec/cer/test_decoder.py
    Hunk #1 succeeded at 389 (offset 25 lines).
    patching file tests/codec/der/test_decoder.py
    Hunk #1 succeeded at 396 (offset 34 lines).

Can you rebase and send a refreshed v2?

Thanks!
-- 
Yoann Congal
Smile ECS