-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 24 Aug 2026 17:02:31 -0300
Source: pyasn1
Architecture: source
Version: 0.6.1-1+deb13u3
Distribution: trixie
Urgency: high
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Emmanuel Arias <eamanu@debian.org>
Closes: 1142388
Changes:
 pyasn1 (0.6.1-1+deb13u3) trixie; urgency=high
 .
   * Team upload.
   * CVE-2026-59886: uncontrolled resource consumption when converting
     decoded real values. univ.Real convertedts  mantissa, base,
     exponens to a Python float using exact big-integer exponentiation,
     so a real value only a few bytes long could carry a very large exponent.
   * CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded
     long-form tag IDs. The BER decoder accumulated tag continuation
     octets without an upper bound, so a crafted substrate could force
     construction of an arbitrarily large integer with quadratic CPU cost
     (Closes: #1142388).
   * CVE-2026-59885: fix quadratic complexity in OBJECT IDENTIFIER and
     RELATIVE-OID decoding and encoding, which allowed denial of service
     via a small payload with many arcs.
Checksums-Sha1:
 525881501d807c000c45f7e8b0ba8f4f7ef0ad3c 2316 pyasn1_0.6.1-1+deb13u3.dsc
 ae93682a9df09a73f2154f4ae9ec5dd3f0830f20 145322 pyasn1_0.6.1.orig.tar.gz
 c94f534b7f5cd56c557780e88fbad2808dd42ab6 14332 pyasn1_0.6.1-1+deb13u3.debian.tar.xz
 d2af811dd25dd360a312f94eba356289de98833b 8848 pyasn1_0.6.1-1+deb13u3_source.buildinfo
Checksums-Sha256:
 bba418ac9b5fe8c734b17096b10b16f9a381942d7f9be1bbb0c70daf24d4d655 2316 pyasn1_0.6.1-1+deb13u3.dsc
 6f580d2bdd84365380830acf45550f2511469f673cb4a5ae3857a3170128b034 145322 pyasn1_0.6.1.orig.tar.gz
 dbcc3d55563558ba54b44b52c894dc0562717f6187fe4f2ebb028a75931c1ec7 14332 pyasn1_0.6.1-1+deb13u3.debian.tar.xz
 69186529f30178f569238495871fca27c365f4074ae12e8e7a9a69877539d4f4 8848 pyasn1_0.6.1-1+deb13u3_source.buildinfo
Files:
 d1bdc843cf7b60771bbefed9a8b7a11b 2316 python optional pyasn1_0.6.1-1+deb13u3.dsc
 75cdc260597f112fdfefec85379e710d 145322 python optional pyasn1_0.6.1.orig.tar.gz
 c524a4cb679829e1b8c5cdb88bf8d949 14332 python optional pyasn1_0.6.1-1+deb13u3.debian.tar.xz
 e14c824007b3174c0cc33d2b61838908 8848 python optional pyasn1_0.6.1-1+deb13u3_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEE3lnVbvHK7ir4q61+p3sXeEcY/EFAmqbHkISHGVhbWFudUBk
ZWJpYW4ub3JnAAoJEPqd7F3hHGPxZVoP/2up/vYHOLHN+toY8JD0x//Jxy4HvsZe
M+TNxB4RXZohU14AFKoIWStWZgrrJjxHEGJ8fo1COuFPmCqpOrxhPivLQnZokM3r
2rEN8DMgIbfHab7Q2xkIxwo+k+cKw+OG3/ZhU8bqwt9anOmyYWjxykm0ss9dKYe/
DVWFOskw3mPGb6tG2PmMVf1iUktgZ4GiHfyhm6OHDKxAYvSl1OR67n9iGzjLADkT
3jNpjnkrX+L0j1edlqQiLo2kgSnZENJ6b97FqNhE6Di8B5yDJyLlgvSRt492pFKJ
2Txgb5r7ZYGkQjTWaZUOs/dEEuU/rkLwql5+b5Ojpltc7g6vRm+FoxQPNGlfrxnG
+IzUAd+xKBidpS4WX+2KhJ2n+AhNSpUhr6EdfFI5W9yW3ZzeCZFcx5sySU5c3LqG
iB5OH0dTxb4BPQeXXXrEciGz2ntsyhNvaK4+opo5BJemXhxVXy2PQlM1BdaMQRms
I7pT8BU3HCwuXuCLA1EMKQHCF+dLVYhHLtDJmK3gKG/WaITAH7L/gSCgvLVPHYcS
KXtbx02zRv8PugONQtYNxGh0XAnPoaC0pzodtvngGw+3sh7pwLsR77cqjm1DePuT
507/4PQlO8vk621d8DtYXbPCkB+DICU+MD6pLlR1/NAVKSrRa2z2VQiN/MV+9wxY
u338RHg9rjgJ
=2XRP
-----END PGP SIGNATURE-----