CVS commit: pkgsrc/security/py-asn1

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Jul  9 04:26:23 UTC 2026

Modified Files:
        pkgsrc/security/py-asn1: Makefile distinfo

Log Message:
py-asn1: updated to 0.6.4

0.6.4, released 08-07-2026

- CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time
  complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders.
  A small crafted substrate encoding many arcs could consume
  excessive CPU. Arcs are now accumulated in linear time; decoded
  values are unchanged (thanks for reporting, tynus2)
- CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag
  IDs to 20 octets (140 bits), matching the OID arc limit introduced
  in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume
  excessive CPU and memory; longer tag IDs are now rejected with
  PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag
  (thanks for reporting, mikeappsec)
  IDs due to the integer-to-string conversion limit (Python 3.11+)
- CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and
  CPU consumption in Real.__float__() for values with large base-10
  exponents. Conversion no longer materializes huge intermediate
  integers; values too large to represent as a Python float raise
  OverflowError promptly, and prettyPrint() renders them as
  '<overflow>' as before. Also fixed base-10 mantissa normalization
  to use exact integer arithmetic; mantissas larger than 2**53
  could previously lose precision through float division
  (thanks for reporting, gvozdila)
- Pinned PyPI publish GitHub Action to an immutable commit


To generate a diff of this commit:
cvs rdiff -u -r1.33 -r1.34 pkgsrc/security/py-asn1/Makefile
cvs rdiff -u -r1.29 -r1.30 pkgsrc/security/py-asn1/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/py-asn1/Makefile
diff -u pkgsrc/security/py-asn1/Makefile:1.33 pkgsrc/security/py-asn1/Makefile:1.34
--- pkgsrc/security/py-asn1/Makefile:1.33       Sat Mar 21 12:04:11 2026
+++ pkgsrc/security/py-asn1/Makefile    Thu Jul  9 04:26:22 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.33 2026/03/21 12:04:11 wiz Exp $
+# $NetBSD: Makefile,v 1.34 2026/07/09 04:26:22 adam Exp $
 
-DISTNAME=      pyasn1-0.6.3
+DISTNAME=      pyasn1-0.6.4
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/^py//}
 CATEGORIES=    security python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=p/pyasn1/}

Index: pkgsrc/security/py-asn1/distinfo
diff -u pkgsrc/security/py-asn1/distinfo:1.29 pkgsrc/security/py-asn1/distinfo:1.30
--- pkgsrc/security/py-asn1/distinfo:1.29       Sat Mar 21 12:04:11 2026
+++ pkgsrc/security/py-asn1/distinfo    Thu Jul  9 04:26:22 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.29 2026/03/21 12:04:11 wiz Exp $
+$NetBSD: distinfo,v 1.30 2026/07/09 04:26:22 adam Exp $
 
-BLAKE2s (pyasn1-0.6.3.tar.gz) = 46618ab4e5e0e0cd7fd2c3922364786f5f870be7dcc6d0228d89970f697319cf
-SHA512 (pyasn1-0.6.3.tar.gz) = c58962b3f11f486da3e73c09dbe2aff7500879b29c4a7be4295878e4edbcaaa2680d608720ad5af86a2457de7da50471ab7a9e925f717db5c467553fc552e6d6
-Size (pyasn1-0.6.3.tar.gz) = 148685 bytes
+BLAKE2s (pyasn1-0.6.4.tar.gz) = 2493a7ad189d1206f4e2e6f0ec315ef3f44bd5b633df9116fb513c49fabe24c5
+SHA512 (pyasn1-0.6.4.tar.gz) = ce04b28d42d41fc8fa20608b773bf6691b46427f73f3fc3fb1a81c06996133bd77dcb2b4f6ba8213e27222d4203adc90adf64eeb7096ec82bc7df6e2f307657d
+Size (pyasn1-0.6.4.tar.gz) = 151262 bytes