diff --git a/CVE-2026-59885.patch b/CVE-2026-59885.patch new file mode 100644 index 0000000000000000000000000000000000000000..1dccbade2f7c9191042d39961c83265834d2bb7d --- /dev/null +++ b/CVE-2026-59885.patch @@ -0,0 +1,286 @@ +From 45bdb19eb7df4b3780fe9c912c63e99bffc39dd9 Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Wed, 8 Jul 2026 17:37:40 -0700 +Subject: [PATCH] Merge commit from fork + +--- + pyasn1/codec/ber/decoder.py | 28 +++++++++++++------------ + pyasn1/codec/ber/encoder.py | 24 +++++++++++----------- + tests/codec/ber/test_decoder.py | 36 +++++++++++++++++++++++++++++++++ + tests/codec/ber/test_encoder.py | 20 ++++++++++++++++++ + 4 files changed, 83 insertions(+), 25 deletions(-) + +diff --git a/pyasn1/codec/ber/decoder.py b/pyasn1/codec/ber/decoder.py +index 1e7eebb3..e1b74e11 100644 +--- a/pyasn1/codec/ber/decoder.py ++++ b/pyasn1/codec/ber/decoder.py +@@ -427,14 +427,14 @@ def valueDecoder(self, substrate, asn1Spec, + if not chunk: + raise error.PyAsn1Error('Empty substrate') + +- oid = () ++ oid = [] + index = 0 + substrateLen = len(chunk) + while index < substrateLen: + subId = chunk[index] + index += 1 + if subId < 128: +- oid += (subId,) ++ oid.append(subId) + elif subId > 128: + # Construct subid from a number of octets + nextSubId = subId +@@ -450,11 +450,11 @@ def valueDecoder(self, substrate, asn1Spec, + subId = (subId << 7) + (nextSubId & 0x7F) + if index >= substrateLen: + raise error.SubstrateUnderrunError( +- 'Short substrate for sub-OID past %s' % (oid,) ++ 'Short substrate for sub-OID past %s' % (tuple(oid),) + ) + nextSubId = chunk[index] + index += 1 +- oid += ((subId << 7) + nextSubId,) ++ oid.append((subId << 7) + nextSubId) + elif subId == 128: + # ASN.1 spec forbids leading zeros (0x80) in OID + # encoding, tolerating it opens a vulnerability. See +@@ -464,15 +464,17 @@ def valueDecoder(self, substrate, asn1Spec, + + # Decode two leading arcs + if 0 <= oid[0] <= 39: +- oid = (0,) + oid ++ oid.insert(0, 0) + elif 40 <= oid[0] <= 79: +- oid = (1, oid[0] - 40) + oid[1:] ++ oid[0] -= 40 ++ oid.insert(0, 1) + elif oid[0] >= 80: +- oid = (2, oid[0] - 80) + oid[1:] ++ oid[0] -= 80 ++ oid.insert(0, 2) + else: + raise error.PyAsn1Error('Malformed first OID octet: %s' % chunk[0]) + +- yield self._createComponent(asn1Spec, tagSet, oid, **options) ++ yield self._createComponent(asn1Spec, tagSet, tuple(oid), **options) + + + class RelativeOIDPayloadDecoder(AbstractSimplePayloadDecoder): +@@ -492,14 +494,14 @@ def valueDecoder(self, substrate, asn1Spec, + if not chunk: + raise error.PyAsn1Error('Empty substrate') + +- reloid = () ++ reloid = [] + index = 0 + substrateLen = len(chunk) + while index < substrateLen: + subId = chunk[index] + index += 1 + if subId < 128: +- reloid += (subId,) ++ reloid.append(subId) + elif subId > 128: + # Construct subid from a number of octets + nextSubId = subId +@@ -515,11 +517,11 @@ def valueDecoder(self, substrate, asn1Spec, + subId = (subId << 7) + (nextSubId & 0x7F) + if index >= substrateLen: + raise error.SubstrateUnderrunError( +- 'Short substrate for sub-OID past %s' % (reloid,) ++ 'Short substrate for sub-OID past %s' % (tuple(reloid),) + ) + nextSubId = chunk[index] + index += 1 +- reloid += ((subId << 7) + nextSubId,) ++ reloid.append((subId << 7) + nextSubId) + elif subId == 128: + # ASN.1 spec forbids leading zeros (0x80) in OID + # encoding, tolerating it opens a vulnerability. See +@@ -527,7 +529,7 @@ def valueDecoder(self, substrate, asn1Spec, + # page 7 + raise error.PyAsn1Error('Invalid octet 0x80 in RELATIVE-OID encoding') + +- yield self._createComponent(asn1Spec, tagSet, reloid, **options) ++ yield self._createComponent(asn1Spec, tagSet, tuple(reloid), **options) + + + class RealPayloadDecoder(AbstractSimplePayloadDecoder): +diff --git a/pyasn1/codec/ber/encoder.py b/pyasn1/codec/ber/encoder.py +index c0c1b344..f06b19e8 100644 +--- a/pyasn1/codec/ber/encoder.py ++++ b/pyasn1/codec/ber/encoder.py +@@ -325,30 +325,30 @@ def encodeValue(self, value, asn1Spec, encodeFun, **options): + else: + raise error.PyAsn1Error('Impossible first/second arcs at %s' % (value,)) + +- octets = () ++ octets = [] + + # Cycle through subIds + for subOid in oid: + if 0 <= subOid <= 127: + # Optimize for the common case +- octets += (subOid,) ++ octets.append(subOid) + + elif subOid > 127: + # Pack large Sub-Object IDs +- res = (subOid & 0x7f,) ++ res = [subOid & 0x7f] + subOid >>= 7 + + while subOid: +- res = (0x80 | (subOid & 0x7f),) + res ++ res.append(0x80 | (subOid & 0x7f)) + subOid >>= 7 + + # Add packed Sub-Object ID to resulted Object ID +- octets += res ++ octets.extend(reversed(res)) + + else: + raise error.PyAsn1Error('Negative OID arc %s at %s' % (subOid, value)) + +- return octets, False, False ++ return tuple(octets), False, False + + + class RelativeOIDEncoder(AbstractItemEncoder): +@@ -358,30 +358,30 @@ def encodeValue(self, value, asn1Spec, encodeFun, **options): + if asn1Spec is not None: + value = asn1Spec.clone(value) + +- octets = () ++ octets = [] + + # Cycle through subIds + for subOid in value.asTuple(): + if 0 <= subOid <= 127: + # Optimize for the common case +- octets += (subOid,) ++ octets.append(subOid) + + elif subOid > 127: + # Pack large Sub-Object IDs +- res = (subOid & 0x7f,) ++ res = [subOid & 0x7f] + subOid >>= 7 + + while subOid: +- res = (0x80 | (subOid & 0x7f),) + res ++ res.append(0x80 | (subOid & 0x7f)) + subOid >>= 7 + + # Add packed Sub-Object ID to resulted RELATIVE-OID +- octets += res ++ octets.extend(reversed(res)) + + else: + raise error.PyAsn1Error('Negative RELATIVE-OID arc %s at %s' % (subOid, value)) + +- return octets, False, False ++ return tuple(octets), False, False + + + class RealEncoder(AbstractItemEncoder): +diff --git a/tests/codec/ber/test_decoder.py b/tests/codec/ber/test_decoder.py +index 563e499b..be9baff3 100644 +--- a/tests/codec/ber/test_decoder.py ++++ b/tests/codec/ber/test_decoder.py +@@ -26,6 +26,14 @@ + from pyasn1 import error + + ++def encode_length(length): ++ if length < 128: ++ return bytes([length]) ++ ++ lengthBytes = length.to_bytes((length.bit_length() + 7) // 8, 'big') ++ return bytes([0x80 | len(lengthBytes)]) + lengthBytes ++ ++ + class LargeTagDecoderTestCase(BaseTestCase): + def testLargeTag(self): + assert decoder.decode(bytes((127, 141, 245, 182, 253, 47, 3, 2, 1, 1))) == (1, b'') +@@ -475,6 +483,20 @@ def testLarge2(self): + bytes((0x06, 0x13, 0x88, 0x37, 0x83, 0xC6, 0xDF, 0xD4, 0xCC, 0xB3, 0xFF, 0xFF, 0xFE, 0xF0, 0xB8, 0xD6, 0xB8, 0xCB, 0xE2, 0xB6, 0x47)) + ) == ((2, 999, 18446744073709551535184467440737095), b'') + ++ def testManySingleByteArcs(self): ++ encodedArcCount = 4096 ++ substrate = ( ++ bytes([0x06]) + ++ encode_length(encodedArcCount) + ++ bytes([0x01] * encodedArcCount) ++ ) ++ ++ value, rest = decoder.decode(substrate) ++ assert rest == b'' ++ assert len(value) == encodedArcCount + 1 ++ assert tuple(value[:3]) == (0, 1, 1) ++ assert tuple(value[-3:]) == (1, 1, 1) ++ + def testExcessiveContinuationOctets(self): + """Test that OID arcs with excessive continuation octets are rejected.""" + # Create a payload with 25 continuation octets (exceeds 20 limit) +@@ -610,6 +632,20 @@ def testLarge(self): + bytes((0x0D, 0x13, 0x88, 0x37, 0x83, 0xC6, 0xDF, 0xD4, 0xCC, 0xB3, 0xFF, 0xFF, 0xFE, 0xF0, 0xB8, 0xD6, 0xB8, 0xCB, 0xE2, 0xB6, 0x47)) + ) == ((1079, 18446744073709551535184467440737095), b'') + ++ def testManySingleByteArcs(self): ++ arcCount = 4096 ++ substrate = ( ++ bytes([0x0d]) + ++ encode_length(arcCount) + ++ bytes([0x01] * arcCount) ++ ) ++ ++ value, rest = decoder.decode(substrate) ++ assert rest == b'' ++ assert len(value) == arcCount ++ assert tuple(value[:3]) == (1, 1, 1) ++ assert tuple(value[-3:]) == (1, 1, 1) ++ + def testExcessiveContinuationOctets(self): + """Test that RELATIVE-OID arcs with excessive continuation octets are rejected.""" + # Create a payload with 25 continuation octets (exceeds 20 limit) +diff --git a/tests/codec/ber/test_encoder.py b/tests/codec/ber/test_encoder.py +index 2bda7167..62484235 100644 +--- a/tests/codec/ber/test_encoder.py ++++ b/tests/codec/ber/test_encoder.py +@@ -348,6 +348,16 @@ def testLarge2(self): + ) == bytes((0x06, 0x13, 0x88, 0x37, 0x83, 0xC6, 0xDF, 0xD4, 0xCC, 0xB3, 0xFF, 0xFF, 0xFE, 0xF0, 0xB8, 0xD6, + 0xB8, 0xCB, 0xE2, 0xB6, 0x47)) + ++ def testManySingleByteArcs(self): ++ arcCount = 4096 ++ substrate = encoder.encode( ++ univ.ObjectIdentifier((1, 3) + (1,) * arcCount) ++ ) ++ ++ assert substrate == ( ++ bytes([0x06, 0x82, 0x10, 0x01, 0x2B]) + bytes([0x01] * arcCount) ++ ) ++ + + class ObjectIdentifierWithSchemaEncoderTestCase(BaseTestCase): + def testOne(self): +@@ -379,6 +389,16 @@ def testLarge(self): + 0xB3, 0xFF, 0xFF, 0xFE, 0xF0, 0xB8, 0xD6, 0xB8, 0xCB, + 0xE2, 0xB6, 0x47)) + ++ def testManySingleByteArcs(self): ++ arcCount = 4096 ++ substrate = encoder.encode( ++ univ.RelativeOID((1,) * arcCount) ++ ) ++ ++ assert substrate == ( ++ bytes([0x0D, 0x82, 0x10, 0x00]) + bytes([0x01] * arcCount) ++ ) ++ + + class RelativeOIDWithSchemaEncoderTestCase(BaseTestCase): + def testOne(self): diff --git a/python-pyasn1.spec b/python-pyasn1.spec index 0ee52d0826de2de564297b2e340d9b34de3d782b..d74a8ec2ec1977e77656bb58340b705f7073e676 100644 --- a/python-pyasn1.spec +++ b/python-pyasn1.spec @@ -1,4 +1,4 @@ -%define anolis_release 3 +%define anolis_release 4 %global module pyasn1 %global modules_version 0.4.2 @@ -16,6 +16,10 @@ BuildRequires: python3-wheel # https://github.com/pyasn1/pyasn1/commit/5a49bd1fe93b5b866a1210f6bf0a3924f21572c8 Patch0001: 0001-add-patch-to-fix-CVE-2026-30922.patch +# CVE-2026-59885 +# Source: upstream +# Reference: https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9 +Patch0002: CVE-2026-59885.patch %description This is an implementation of ASN.1 types and codecs in the Python programming @@ -54,6 +58,7 @@ Requires: python3-pyasn1 = %{EVR} %prep %setup -n %{module}-%{version} -q -b1 %patch01 -p1 +%patch02 -p1 %build %{__python3} -m pip wheel --no-build-isolation --no-deps --wheel-dir %{_builddir}/pyasn1-wheels . @@ -95,6 +100,10 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest tests/ -v %doc docs/build/html/* %changelog +* Sat Aug 29 2026 PengLAI Code - 0.6.2-4 +- Fix CVE-2026-59885 +- Upstream patch: https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9 + * Tue Mar 24 2026 lzq11122 - 0.6.2-3 - Add patch to fix CVE-2026-30922