Ubuntu alert USN-8712-1 (pyasn1)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8712-1] pyasn1 vulnerabilities
Date:
             
 
Tue, 01 Sep 2026 17:36:31 +0000
Message-ID:
             
 
<E1x1SPP-0007JQ-BO@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8712-1
September 01, 2026

pyasn1 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in pyasn1.

Software Description:
- pyasn1: ASN.1 library for Python

Details:

It was discovered that pyasn1 did not properly bound the size of long-form
tag identifiers when parsing BER, CER, or DER encoded data. An attacker
could possibly use this issue to cause applications decoding untrusted
ASN.1 data to consume excessive CPU resources, resulting in a denial of
service. (CVE-2026-59884)

It was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID
values in quadratic time relative to the number of arcs. An attacker could
possibly use this issue to cause applications decoding untrusted ASN.1 data
to consume excessive CPU resources, resulting in a denial of service.
(CVE-2026-59885)

It was discovered that pyasn1 incorrectly handled conversion of decoded
REAL values to Python float types. An attacker could possibly use this
issue to cause applications decoding untrusted ASN.1 data to consume
excessive CPU and memory resources, resulting in a denial of service.
(CVE-2026-59886)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  python3-pyasn1                  0.6.3-1ubuntu0.1

Ubuntu 24.04 LTS
  python3-pyasn1                  0.4.8-4ubuntu0.3

Ubuntu 22.04 LTS
  python3-pyasn1                  0.4.8-1ubuntu0.3

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8712-1
  CVE-2026-59884, CVE-2026-59885, CVE-2026-59886

Package Information:
  https://launchpad.net/ubuntu/+source/pyasn1/0.6.3-1ubuntu0.1
  https://launchpad.net/ubuntu/+source/pyasn1/0.4.8-4ubuntu0.3
  https://launchpad.net/ubuntu/+source/pyasn1/0.4.8-1ubuntu0.3


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmqXDOkACgkQcpJm3tlz
hgE1rhAAsq2ixGrz5sKqUzoDmQsVNiYFur3QiSauraytetzowKqF2BXepNaWjVVK
2U1wQlwoUbTjo3IHhGQ7EXCeG3k+T9BTT42aeYvmf8h8OANkUYWi7/l+fAs9k1VF
O+8zAUcDev7fKWryAF1mWhZE2XunBKldmvo1U39a7GTHUPprnzwFz9mfdg+PIMRY
a42zo0fx5LXLTMME9VI21CCgJeH8hf5B3hov7bI2AzrDSF6eoTaWDNMy9A5tw58i
0GYWpatz9IKeanojZlwDdfmFK0fbGMO/DAK6gbEtMaCd/U0RKbIb5YMvbZf2CiY9
NorVKWstsyrre6/kRlpuc8tytgpPv+oLRt43LKbZ5UCJfrJi8N/fitehbBWPMS91
IdiSzZ3eOUvAM9Fve01/+Sx2ZkfoPmFNLTRPIcl08NFqzQ7DOqh4ZBS8ybDbqr/T
1xsDdSeWuZfzmRaoa9rQwETvNRNujiBFZJBQqHoFfuQ9Kr+YLu+mkGhyZm+j7zx5
YU30ez3H0j1Grw2EYvPn2bWLdKqtWEgR4/OLYZ4TpNtTcdpbExxe8NX3yJVofuGM
EQ1f3vuX8m3FRAq1A2tdKN1UKyl+WVMGfX5gpf1tzChn5O9vahZK1gcjTED15qtW
f41j2yywKOZWQyJFKfWuffQWImPBdysmStUBLcf8NHhQXnavUYI=
=Pwtb
-----END PGP SIGNATURE-----