* [OE-core][scarthgap][PATCH 1/2] python3-pyasn1: fix CVE-2026-30922
@ 2026-08-27 6:31 Yogita Urade
2026-08-27 6:31 ` [OE-core][scarthgap][PATCH 2/2] python3-pyasn1: fix CVE-2026-59885 Yogita Urade
2026-09-18 7:39 ` [OE-core][scarthgap][PATCH 1/2] python3-pyasn1: fix CVE-2026-30922 Yoann Congal
0 siblings, 2 replies; 3+ messages in thread
From: Yogita Urade @ 2026-08-27 6:31 UTC (permalink / raw)
To: openembedded-core
This patch applies upstream fix for CVE-2026-30922 as referenced in [2],
using the upstream commit identified in [1].
[1] https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-30922
Signed-off-by: Yogita Urade <yurade@cisco.com>
---
.../recipes-devtools/python/python-pyasn1.inc | 1 +
.../python3-pyasn1/CVE-2026-30922.patch | 260 ++++++++++++++++++
2 files changed, 261 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
diff --git a/meta/recipes-devtools/python/python-pyasn1.inc b/meta/recipes-devtools/python/python-pyasn1.inc
index 96b4a3b52a..d69cdf8877 100644
--- a/meta/recipes-devtools/python/python-pyasn1.inc
+++ b/meta/recipes-devtools/python/python-pyasn1.inc
@@ -19,6 +19,7 @@ inherit ptest
SRC_URI += " \
file://run-ptest \
file://CVE-2026-23490.patch \
+ file://CVE-2026-30922.patch \
"
RDEPENDS:${PN}-ptest += " \
diff --git a/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch b/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
new file mode 100644
index 0000000000..aad4829f82
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
@@ -0,0 +1,260 @@
+From b10f9a671c66a99b91bd916e62a0c81541094dd6 Mon Sep 17 00:00:00 2001
+From: Simon Pichugin <simon.pichugin@gmail.com>
+Date: Mon, 16 Mar 2026 17:23:11 -0700
+Subject: [PATCH] Merge commit from fork
+
+CVE: CVE-2026-30922
+Upstream-Status: Backport [https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0]
+
+(cherry picked from commit 25ad481c19fdb006e20485ef3fc2e5b3eff30ef0)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ pyasn1/codec/ber/decoder.py | 10 +++
+ tests/codec/ber/test_decoder.py | 116 ++++++++++++++++++++++++++++++++
+ tests/codec/cer/test_decoder.py | 24 +++++++
+ tests/codec/der/test_decoder.py | 42 ++++++++++++
+ 4 files changed, 192 insertions(+)
+
+diff --git a/pyasn1/codec/ber/decoder.py b/pyasn1/codec/ber/decoder.py
+index be8ba65..da2a048 100644
+--- a/pyasn1/codec/ber/decoder.py
++++ b/pyasn1/codec/ber/decoder.py
+@@ -38,6 +38,7 @@ SubstrateUnderrunError = error.SubstrateUnderrunError
+ # Maximum number of continuation octets (high-bit set) allowed per OID arc.
+ # 20 octets allows up to 140-bit integers, supporting UUID-based OIDs
+ MAX_OID_ARC_CONTINUATION_OCTETS = 20
++MAX_NESTING_DEPTH = 100
+
+
+ class AbstractPayloadDecoder(object):
+@@ -1515,6 +1516,15 @@ class SingleItemDecoder(object):
+ decodeFun=None, substrateFun=None,
+ **options):
+
++ _nestingLevel = options.get('_nestingLevel', 0)
++
++ if _nestingLevel > MAX_NESTING_DEPTH:
++ raise error.PyAsn1Error(
++ 'ASN.1 structure nesting depth exceeds limit (%d)' % MAX_NESTING_DEPTH
++ )
++
++ options['_nestingLevel'] = _nestingLevel + 1
++
+ allowEoo = options.pop('allowEoo', False)
+
+ if LOG:
+diff --git a/tests/codec/ber/test_decoder.py b/tests/codec/ber/test_decoder.py
+index f033dfd..62aa1c5 100644
+--- a/tests/codec/ber/test_decoder.py
++++ b/tests/codec/ber/test_decoder.py
+@@ -1988,6 +1988,122 @@ class CompressedFilesTestCase(BaseTestCase):
+ os.remove(path)
+
+
++class NestingDepthLimitTestCase(BaseTestCase):
++ """Test protection against deeply nested ASN.1 structures (CVE prevention)."""
++
++ def testIndefLenSequenceNesting(self):
++ """Deeply nested indefinite-length SEQUENCEs must raise PyAsn1Error."""
++ # Each \x30\x80 opens a new indefinite-length SEQUENCE
++ payload = b'\x30\x80' * 200
++ try:
++ decoder.decode(payload)
++ except error.PyAsn1Error:
++ pass
++ else:
++ assert False, 'Deeply nested indef-length SEQUENCEs not rejected'
++
++ def testIndefLenSetNesting(self):
++ """Deeply nested indefinite-length SETs must raise PyAsn1Error."""
++ # Each \x31\x80 opens a new indefinite-length SET
++ payload = b'\x31\x80' * 200
++ try:
++ decoder.decode(payload)
++ except error.PyAsn1Error:
++ pass
++ else:
++ assert False, 'Deeply nested indef-length SETs not rejected'
++
++ def testDefiniteLenNesting(self):
++ """Deeply nested definite-length SEQUENCEs must raise PyAsn1Error."""
++ inner = b'\x05\x00' # NULL
++ for _ in range(200):
++ length = len(inner)
++ if length < 128:
++ inner = b'\x30' + bytes([length]) + inner
++ else:
++ length_bytes = length.to_bytes(
++ (length.bit_length() + 7) // 8, 'big')
++ inner = b'\x30' + bytes([0x80 | len(length_bytes)]) + \
++ length_bytes + inner
++ try:
++ decoder.decode(inner)
++ except error.PyAsn1Error:
++ pass
++ else:
++ assert False, 'Deeply nested definite-length SEQUENCEs not rejected'
++
++ def testNestingUnderLimitWorks(self):
++ """Nesting within the limit must decode successfully."""
++ inner = b'\x05\x00' # NULL
++ for _ in range(50):
++ length = len(inner)
++ if length < 128:
++ inner = b'\x30' + bytes([length]) + inner
++ else:
++ length_bytes = length.to_bytes(
++ (length.bit_length() + 7) // 8, 'big')
++ inner = b'\x30' + bytes([0x80 | len(length_bytes)]) + \
++ length_bytes + inner
++ asn1Object, _ = decoder.decode(inner)
++ assert asn1Object is not None, 'Valid nested structure rejected'
++
++ def testSiblingsDontIncreaseDepth(self):
++ """Sibling elements at the same level must not inflate depth count."""
++ # SEQUENCE containing 200 INTEGER siblings - should decode fine
++ components = b'\x02\x01\x01' * 200 # 200 x INTEGER(1)
++ length = len(components)
++ length_bytes = length.to_bytes(
++ (length.bit_length() + 7) // 8, 'big')
++ payload = b'\x30' + bytes([0x80 | len(length_bytes)]) + \
++ length_bytes + components
++ asn1Object, _ = decoder.decode(payload)
++ assert asn1Object is not None, 'Siblings incorrectly rejected'
++
++ def testErrorMessageContainsLimit(self):
++ """Error message must indicate the nesting depth limit."""
++ payload = b'\x30\x80' * 200
++ try:
++ decoder.decode(payload)
++ except error.PyAsn1Error as exc:
++ assert 'nesting depth' in str(exc).lower(), \
++ 'Error message missing depth info: %s' % exc
++ else:
++ assert False, 'Expected PyAsn1Error'
++
++ def testNoRecursionError(self):
++ """Must raise PyAsn1Error, not RecursionError."""
++ payload = b'\x30\x80' * 50000
++ try:
++ decoder.decode(payload)
++ except error.PyAsn1Error:
++ pass
++ except RecursionError:
++ assert False, 'Got RecursionError instead of PyAsn1Error'
++
++ def testMixedNesting(self):
++ """Mixed SEQUENCE and SET nesting must be caught."""
++ # Alternate SEQUENCE (0x30) and SET (0x31) with indef length
++ payload = b''
++ for i in range(200):
++ payload += b'\x30\x80' if i % 2 == 0 else b'\x31\x80'
++ try:
++ decoder.decode(payload)
++ except error.PyAsn1Error:
++ pass
++ else:
++ assert False, 'Mixed nesting not rejected'
++
++ def testWithSchema(self):
++ """Deeply nested structures must be caught even with schema."""
++ payload = b'\x30\x80' * 200
++ try:
++ decoder.decode(payload, asn1Spec=univ.Sequence())
++ except error.PyAsn1Error:
++ pass
++ else:
++ assert False, 'Deeply nested with schema not rejected'
++
++
+ class NonStreamingCompatibilityTestCase(BaseTestCase):
+ def setUp(self):
+ from pyasn1 import debug
+diff --git a/tests/codec/cer/test_decoder.py b/tests/codec/cer/test_decoder.py
+index 133affd..cdaa742 100644
+--- a/tests/codec/cer/test_decoder.py
++++ b/tests/codec/cer/test_decoder.py
+@@ -364,6 +364,30 @@ class SequenceDecoderWithExplicitlyTaggedSetOfOpenTypesTestCase(BaseTestCase):
+ assert s[1][0] == univ.OctetString(hexValue='02010C')
+
+
++class NestingDepthLimitTestCase(BaseTestCase):
++ """Test CER decoder protection against deeply nested structures."""
++
++ def testIndefLenNesting(self):
++ """Deeply nested indefinite-length SEQUENCEs must raise PyAsn1Error."""
++ payload = b'\x30\x80' * 200
++ try:
++ decoder.decode(payload)
++ except PyAsn1Error:
++ pass
++ else:
++ assert False, 'Deeply nested indef-length SEQUENCEs not rejected'
++
++ def testNoRecursionError(self):
++ """Must raise PyAsn1Error, not RecursionError."""
++ payload = b'\x30\x80' * 50000
++ try:
++ decoder.decode(payload)
++ except PyAsn1Error:
++ pass
++ except RecursionError:
++ assert False, 'Got RecursionError instead of PyAsn1Error'
++
++
+ suite = unittest.TestLoader().loadTestsFromModule(sys.modules[__name__])
+
+ if __name__ == '__main__':
+diff --git a/tests/codec/der/test_decoder.py b/tests/codec/der/test_decoder.py
+index 5bc9deb..17de466 100644
+--- a/tests/codec/der/test_decoder.py
++++ b/tests/codec/der/test_decoder.py
+@@ -362,6 +362,48 @@ class SequenceDecoderWithExplicitlyTaggedSetOfOpenTypesTestCase(BaseTestCase):
+ assert s[1][0] == univ.OctetString(hexValue='02010C')
+
+
++class NestingDepthLimitTestCase(BaseTestCase):
++ """Test DER decoder protection against deeply nested structures."""
++
++ def testDefiniteLenNesting(self):
++ """Deeply nested definite-length SEQUENCEs must raise PyAsn1Error."""
++ inner = b'\x05\x00' # NULL
++ for _ in range(200):
++ length = len(inner)
++ if length < 128:
++ inner = b'\x30' + bytes([length]) + inner
++ else:
++ length_bytes = length.to_bytes(
++ (length.bit_length() + 7) // 8, 'big')
++ inner = b'\x30' + bytes([0x80 | len(length_bytes)]) + \
++ length_bytes + inner
++ try:
++ decoder.decode(inner)
++ except PyAsn1Error:
++ pass
++ else:
++ assert False, 'Deeply nested definite-length SEQUENCEs not rejected'
++
++ def testNoRecursionError(self):
++ """Must raise PyAsn1Error, not RecursionError."""
++ inner = b'\x05\x00'
++ for _ in range(200):
++ length = len(inner)
++ if length < 128:
++ inner = b'\x30' + bytes([length]) + inner
++ else:
++ length_bytes = length.to_bytes(
++ (length.bit_length() + 7) // 8, 'big')
++ inner = b'\x30' + bytes([0x80 | len(length_bytes)]) + \
++ length_bytes + inner
++ try:
++ decoder.decode(inner)
++ except PyAsn1Error:
++ pass
++ except RecursionError:
++ assert False, 'Got RecursionError instead of PyAsn1Error'
++
++
+ suite = unittest.TestLoader().loadTestsFromModule(sys.modules[__name__])
+
+ if __name__ == '__main__':
--
2.35.6
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [OE-core][scarthgap][PATCH 2/2] python3-pyasn1: fix CVE-2026-59885
2026-08-27 6:31 [OE-core][scarthgap][PATCH 1/2] python3-pyasn1: fix CVE-2026-30922 Yogita Urade
@ 2026-08-27 6:31 ` Yogita Urade
2026-09-18 7:39 ` [OE-core][scarthgap][PATCH 1/2] python3-pyasn1: fix CVE-2026-30922 Yoann Congal
1 sibling, 0 replies; 3+ messages in thread
From: Yogita Urade @ 2026-08-27 6:31 UTC (permalink / raw)
To: openembedded-core
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
[1] https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59885
Signed-off-by: Yogita Urade <yurade@cisco.com>
---
.../recipes-devtools/python/python-pyasn1.inc | 1 +
.../python3-pyasn1/CVE-2026-59885.patch | 184 ++++++++++++++++++
2 files changed, 185 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3-pyasn1/CVE-2026-59885.patch
diff --git a/meta/recipes-devtools/python/python-pyasn1.inc b/meta/recipes-devtools/python/python-pyasn1.inc
index d69cdf8877..ec06281612 100644
--- a/meta/recipes-devtools/python/python-pyasn1.inc
+++ b/meta/recipes-devtools/python/python-pyasn1.inc
@@ -20,6 +20,7 @@ SRC_URI += " \
file://run-ptest \
file://CVE-2026-23490.patch \
file://CVE-2026-30922.patch \
+ file://CVE-2026-59885.patch \
"
RDEPENDS:${PN}-ptest += " \
diff --git a/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-59885.patch b/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-59885.patch
new file mode 100644
index 0000000000..d8cc924875
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-59885.patch
@@ -0,0 +1,184 @@
+From 865e458893e475ab2e6a46022329f7f4870e8044 Mon Sep 17 00:00:00 2001
+From: Simon Pichugin <simon.pichugin@gmail.com>
+Date: Wed, 8 Jul 2026 17:37:40 -0700
+Subject: [PATCH] Merge commit from fork
+
+CVE: CVE-2026-59885
+Upstream-Status: Backport [https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9]
+
+Backport Changes:
+- Omitted RelativeOID decoder and encoder changes, together with their
+ decoder and encoder regression tests, because RelativeOID support was
+ introduced in pyasn1 0.6.0 and is absent from pyasn1 0.5.1
+
+(cherry picked from commit 45bdb19eb7df4b3780fe9c912c63e99bffc39dd9)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ pyasn1/codec/ber/decoder.py | 18 ++++++++++--------
+ pyasn1/codec/ber/encoder.py | 12 ++++++------
+ tests/codec/ber/test_decoder.py | 22 ++++++++++++++++++++++
+ tests/codec/ber/test_encoder.py | 10 ++++++++++
+ 4 files changed, 48 insertions(+), 14 deletions(-)
+
+diff --git a/pyasn1/codec/ber/decoder.py b/pyasn1/codec/ber/decoder.py
+index da2a048..72c9cb5 100644
+--- a/pyasn1/codec/ber/decoder.py
++++ b/pyasn1/codec/ber/decoder.py
+@@ -424,14 +424,14 @@ class ObjectIdentifierPayloadDecoder(AbstractSimplePayloadDecoder):
+
+ chunk = octs2ints(chunk)
+
+- oid = ()
++ oid = []
+ index = 0
+ substrateLen = len(chunk)
+ while index < substrateLen:
+ subId = chunk[index]
+ index += 1
+ if subId < 128:
+- oid += (subId,)
++ oid.append(subId)
+ elif subId > 128:
+ # Construct subid from a number of octets
+ nextSubId = subId
+@@ -447,11 +447,11 @@ class ObjectIdentifierPayloadDecoder(AbstractSimplePayloadDecoder):
+ subId = (subId << 7) + (nextSubId & 0x7F)
+ if index >= substrateLen:
+ raise error.SubstrateUnderrunError(
+- 'Short substrate for sub-OID past %s' % (oid,)
++ 'Short substrate for sub-OID past %s' % (tuple(oid),)
+ )
+ nextSubId = chunk[index]
+ index += 1
+- oid += ((subId << 7) + nextSubId,)
++ oid.append((subId << 7) + nextSubId)
+ elif subId == 128:
+ # ASN.1 spec forbids leading zeros (0x80) in OID
+ # encoding, tolerating it opens a vulnerability. See
+@@ -461,15 +461,17 @@ class ObjectIdentifierPayloadDecoder(AbstractSimplePayloadDecoder):
+
+ # Decode two leading arcs
+ if 0 <= oid[0] <= 39:
+- oid = (0,) + oid
++ oid.insert(0, 0)
+ elif 40 <= oid[0] <= 79:
+- oid = (1, oid[0] - 40) + oid[1:]
++ oid[0] -= 40
++ oid.insert(0, 1)
+ elif oid[0] >= 80:
+- oid = (2, oid[0] - 80) + oid[1:]
++ oid[0] -= 80
++ oid.insert(0, 2)
+ else:
+ raise error.PyAsn1Error('Malformed first OID octet: %s' % chunk[0])
+
+- yield self._createComponent(asn1Spec, tagSet, oid, **options)
++ yield self._createComponent(asn1Spec, tagSet, tuple(oid), **options)
+
+
+ class RealPayloadDecoder(AbstractSimplePayloadDecoder):
+diff --git a/pyasn1/codec/ber/encoder.py b/pyasn1/codec/ber/encoder.py
+index c59b43e..7c3c5cf 100644
+--- a/pyasn1/codec/ber/encoder.py
++++ b/pyasn1/codec/ber/encoder.py
+@@ -327,30 +327,30 @@ class ObjectIdentifierEncoder(AbstractItemEncoder):
+ else:
+ raise error.PyAsn1Error('Impossible first/second arcs at %s' % (value,))
+
+- octets = ()
++ octets = []
+
+ # Cycle through subIds
+ for subOid in oid:
+ if 0 <= subOid <= 127:
+ # Optimize for the common case
+- octets += (subOid,)
++ octets.append(subOid)
+
+ elif subOid > 127:
+ # Pack large Sub-Object IDs
+- res = (subOid & 0x7f,)
++ res = [subOid & 0x7f]
+ subOid >>= 7
+
+ while subOid:
+- res = (0x80 | (subOid & 0x7f),) + res
++ res.append(0x80 | (subOid & 0x7f))
+ subOid >>= 7
+
+ # Add packed Sub-Object ID to resulted Object ID
+- octets += res
++ octets.extend(reversed(res))
+
+ else:
+ raise error.PyAsn1Error('Negative OID arc %s at %s' % (subOid, value))
+
+- return octets, False, False
++ return tuple(octets), False, False
+
+
+ class RealEncoder(AbstractItemEncoder):
+diff --git a/tests/codec/ber/test_decoder.py b/tests/codec/ber/test_decoder.py
+index 62aa1c5..c7a75cb 100644
+--- a/tests/codec/ber/test_decoder.py
++++ b/tests/codec/ber/test_decoder.py
+@@ -26,6 +26,14 @@ from pyasn1.compat.octets import ints2octs, str2octs, null
+ from pyasn1 import error
+
+
++def encode_length(length):
++ if length < 128:
++ return bytes([length])
++
++ lengthBytes = length.to_bytes((length.bit_length() + 7) // 8, 'big')
++ return bytes([0x80 | len(lengthBytes)]) + lengthBytes
++
++
+ class LargeTagDecoderTestCase(BaseTestCase):
+ def testLargeTag(self):
+ assert decoder.decode(ints2octs((127, 141, 245, 182, 253, 47, 3, 2, 1, 1))) == (1, null)
+@@ -450,6 +458,20 @@ class ObjectIdentifierDecoderTestCase(BaseTestCase):
+ ints2octs((0x06, 0x13, 0x88, 0x37, 0x83, 0xC6, 0xDF, 0xD4, 0xCC, 0xB3, 0xFF, 0xFF, 0xFE, 0xF0, 0xB8, 0xD6, 0xB8, 0xCB, 0xE2, 0xB6, 0x47))
+ ) == ((2, 999, 18446744073709551535184467440737095), null)
+
++ def testManySingleByteArcs(self):
++ encodedArcCount = 4096
++ substrate = (
++ bytes([0x06]) +
++ encode_length(encodedArcCount) +
++ bytes([0x01] * encodedArcCount)
++ )
++
++ value, rest = decoder.decode(substrate)
++ assert rest == b''
++ assert len(value) == encodedArcCount + 1
++ assert tuple(value[:3]) == (0, 1, 1)
++ assert tuple(value[-3:]) == (1, 1, 1)
++
+ def testExcessiveContinuationOctets(self):
+ """Test that OID arcs with excessive continuation octets are rejected."""
+ # Create a payload with 25 continuation octets (exceeds 20 limit)
+diff --git a/tests/codec/ber/test_encoder.py b/tests/codec/ber/test_encoder.py
+index 3d7567a..ef38eef 100644
+--- a/tests/codec/ber/test_encoder.py
++++ b/tests/codec/ber/test_encoder.py
+@@ -349,6 +349,16 @@ class ObjectIdentifierEncoderTestCase(BaseTestCase):
+ ) == ints2octs((0x06, 0x13, 0x88, 0x37, 0x83, 0xC6, 0xDF, 0xD4, 0xCC, 0xB3, 0xFF, 0xFF, 0xFE, 0xF0, 0xB8, 0xD6,
+ 0xB8, 0xCB, 0xE2, 0xB6, 0x47))
+
++ def testManySingleByteArcs(self):
++ arcCount = 4096
++ substrate = encoder.encode(
++ univ.ObjectIdentifier((1, 3) + (1,) * arcCount)
++ )
++
++ assert substrate == (
++ bytes([0x06, 0x82, 0x10, 0x01, 0x2B]) + bytes([0x01] * arcCount)
++ )
++
+
+ class ObjectIdentifierWithSchemaEncoderTestCase(BaseTestCase):
+ def testOne(self):
+--
+2.44.1
+
--
2.35.6
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [OE-core][scarthgap][PATCH 1/2] python3-pyasn1: fix CVE-2026-30922
2026-08-27 6:31 [OE-core][scarthgap][PATCH 1/2] python3-pyasn1: fix CVE-2026-30922 Yogita Urade
2026-08-27 6:31 ` [OE-core][scarthgap][PATCH 2/2] python3-pyasn1: fix CVE-2026-59885 Yogita Urade
@ 2026-09-18 7:39 ` Yoann Congal
1 sibling, 0 replies; 3+ messages in thread
From: Yoann Congal @ 2026-09-18 7:39 UTC (permalink / raw)
To: yurade, openembedded-core
On Thu Aug 27, 2026 at 8:31 AM CEST, Yogita Urade -X (yurade - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> This patch applies upstream fix for CVE-2026-30922 as referenced in [2],
> using the upstream commit identified in [1].
>
> [1] https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0
> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-30922
>
> Signed-off-by: Yogita Urade <yurade@cisco.com>
> ---
> .../recipes-devtools/python/python-pyasn1.inc | 1 +
> .../python3-pyasn1/CVE-2026-30922.patch | 260 ++++++++++++++++++
> 2 files changed, 261 insertions(+)
> create mode 100644 meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
>
> diff --git a/meta/recipes-devtools/python/python-pyasn1.inc b/meta/recipes-devtools/python/python-pyasn1.inc
> index 96b4a3b52a..d69cdf8877 100644
> --- a/meta/recipes-devtools/python/python-pyasn1.inc
> +++ b/meta/recipes-devtools/python/python-pyasn1.inc
> @@ -19,6 +19,7 @@ inherit ptest
> SRC_URI += " \
> file://run-ptest \
> file://CVE-2026-23490.patch \
> + file://CVE-2026-30922.patch \
> "
>
> RDEPENDS:${PN}-ptest += " \
> diff --git a/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch b/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
> new file mode 100644
> index 0000000000..aad4829f82
> --- /dev/null
> +++ b/meta/recipes-devtools/python/python3-pyasn1/CVE-2026-30922.patch
> @@ -0,0 +1,260 @@
> +From b10f9a671c66a99b91bd916e62a0c81541094dd6 Mon Sep 17 00:00:00 2001
> +From: Simon Pichugin <simon.pichugin@gmail.com>
> +Date: Mon, 16 Mar 2026 17:23:11 -0700
> +Subject: [PATCH] Merge commit from fork
> +
> +CVE: CVE-2026-30922
> +Upstream-Status: Backport [https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0]
> +
> +(cherry picked from commit 25ad481c19fdb006e20485ef3fc2e5b3eff30ef0)
> +Signed-off-by: Yogita Urade <yurade@cisco.com>
> +---
> + pyasn1/codec/ber/decoder.py | 10 +++
> + tests/codec/ber/test_decoder.py | 116 ++++++++++++++++++++++++++++++++
> + tests/codec/cer/test_decoder.py | 24 +++++++
> + tests/codec/der/test_decoder.py | 42 ++++++++++++
> + 4 files changed, 192 insertions(+)
Hello,
Thanks for the patch but it does not apply cleanly (surely a conflict
with the other recent CVE fixes):
ERROR: python3-pyasn1-0.5.1-r0 do_patch: QA Issue: Fuzz detected:
Applying patch CVE-2026-30922.patch
patching file pyasn1/codec/ber/decoder.py
Hunk #1 succeeded at 38 with fuzz 2.
Hunk #2 succeeded at 1520 (offset 4 lines).
patching file tests/codec/ber/test_decoder.py
Hunk #1 succeeded at 2048 (offset 60 lines).
patching file tests/codec/cer/test_decoder.py
Hunk #1 succeeded at 389 (offset 25 lines).
patching file tests/codec/der/test_decoder.py
Hunk #1 succeeded at 396 (offset 34 lines).
Can you rebase and send a refreshed v2?
Thanks!
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-18 7:39 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-27 6:31 [OE-core][scarthgap][PATCH 1/2] python3-pyasn1: fix CVE-2026-30922 Yogita Urade
2026-08-27 6:31 ` [OE-core][scarthgap][PATCH 2/2] python3-pyasn1: fix CVE-2026-59885 Yogita Urade
2026-09-18 7:39 ` [OE-core][scarthgap][PATCH 1/2] python3-pyasn1: fix CVE-2026-30922 Yoann Congal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox