Register | Log in

pyasn1

Choose email to subscribe with

general

source: pyasn1 (main)
version: 0.6.4-1
maintainer: Debian Python Team (DMD)
uploaders: Deepak Tripathi [DMD] – Vincent Bernat [DMD] – Jan Lübbe [DMD] – Alexandre Detiste [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.4.8-1
o-o-sec: 0.4.8-1+deb11u2
oldstable: 0.4.8-3+deb12u2
old-sec: 0.4.8-3+deb12u2
stable: 0.6.1-1+deb13u2
stable-sec: 0.6.1-1+deb13u2
stable-bpo: 0.6.2-1~bpo13+1
testing: 0.6.3-1
unstable: 0.6.4-1

versioned links

0.4.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.4.8-1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.4.8-3+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.6.1-1+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.6.2-1~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.6.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.6.4-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python-pyasn1-doc
python3-pyasn1

action needed

3 security issues in trixie high

There are 3 open security issues in trixie.

3 important issues:

CVE-2026-59884: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
CVE-2026-59885: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
CVE-2026-59886: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.

Created: 2026-07-15 Last update: 2026-07-21 23:31

3 security issues in forky high

There are 3 open security issues in forky.

3 important issues:

CVE-2026-59884: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
CVE-2026-59885: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
CVE-2026-59886: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.

Created: 2026-07-15 Last update: 2026-07-21 23:31

3 security issues in bullseye high

There are 3 open security issues in bullseye.

3 important issues:

CVE-2026-59884: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
CVE-2026-59885: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
CVE-2026-59886: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.

Created: 2026-07-15 Last update: 2026-07-21 23:31

3 security issues in bookworm high

There are 3 open security issues in bookworm.

3 important issues:

CVE-2026-59884: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
CVE-2026-59885: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
CVE-2026-59886: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.

Created: 2026-07-15 Last update: 2026-07-21 23:31

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-03-21 Last update: 2026-03-21 05:01

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 0.6.4-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-07-21 22:01

testing migrations

excuses:
- Migrates after: sphinx
- Migration status for pyasn1 (0.6.3-1 to 0.6.4-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for ironic/1:35.0.1-8: amd64: Pass, arm64: Pass, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻, loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: Pass, riscv64: Regression ♻ (reference ♻), s390x: Pass
- ∙ ∙ Autopkgtest for pyasn1/0.6.4-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Lintian check waiting for test results - info
- ∙ ∙ Too young, only 1 of 5 days old
- ∙ ∙ Built-Using: pyasn1 sphinx (not considered)
- Additional info (not blocking):
- ∙ ∙ Updating pyasn1 will fix bugs in testing: #1142388
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/p/pyasn1.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[2026-07-21] Accepted pyasn1 0.6.4-1 (source) into unstable (Colin Watson)
[2026-05-01] Accepted pyasn1 0.4.8-1+deb11u2 (source) into oldoldstable-security (Emmanuel Arias)
[2026-04-03] Accepted pyasn1 0.4.8-3+deb12u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-04-03] Accepted pyasn1 0.6.1-1+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-04-03] Accepted pyasn1 0.4.8-3+deb12u2 (source) into oldstable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-04-03] Accepted pyasn1 0.6.1-1+deb13u2 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-03-24] pyasn1 0.6.3-1 MIGRATED to testing (Debian testing watch)
[2026-03-20] Accepted pyasn1 0.6.3-1 (source) into unstable (Alexandre Detiste)
[2026-03-05] Accepted pyasn1 0.6.2-1~bpo13+1 (source all) into stable-backports (Debian FTP Masters) (signed by: Christopher Obbard)
[2026-02-01] Accepted pyasn1 0.4.8-1+deb11u1 (source) into oldoldstable-security (Utkarsh Gupta)
[2026-01-29] Accepted pyasn1 0.4.8-3+deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-01-29] Accepted pyasn1 0.6.1-1+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-01-28] Accepted pyasn1 0.4.8-3+deb12u1 (source) into oldstable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-01-28] Accepted pyasn1 0.6.1-1+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-01-22] pyasn1 0.6.2-1 MIGRATED to testing (Debian testing watch)
[2026-01-19] Accepted pyasn1 0.6.2-1 (source) into unstable (Alexandre Detiste)
[2025-02-28] pyasn1 0.6.1-1 MIGRATED to testing (Debian testing watch)
[2025-02-13] Accepted pyasn1 0.6.1-1 (source) into unstable (Alexandre Detiste)
[2024-08-29] pyasn1 0.6.0-1 MIGRATED to testing (Debian testing watch)
[2024-08-22] Accepted pyasn1 0.6.0-1 (source) into unstable (Alexandre Detiste)
[2024-04-15] pyasn1 0.5.1-1 MIGRATED to testing (Debian testing watch)
[2024-04-08] Accepted pyasn1 0.5.1-1 (source) into unstable (Thomas Goirand)
[2023-07-19] pyasn1 0.4.8-4 MIGRATED to testing (Debian testing watch)
[2023-07-13] Accepted pyasn1 0.4.8-4 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2022-12-30] pyasn1 0.4.8-3 MIGRATED to testing (Debian testing watch)
[2022-12-24] Accepted pyasn1 0.4.8-3 (source) into unstable (Jochen Sprickerhof)
[2022-10-29] pyasn1 0.4.8-2.1 MIGRATED to testing (Debian testing watch)
[2022-10-23] Accepted pyasn1 0.4.8-2.1 (source) into unstable (Paul Gevers)
[2022-06-13] pyasn1 0.4.8-2 MIGRATED to testing (Debian testing watch)
[2022-06-03] Accepted pyasn1 0.4.8-2 (source) into unstable (Sandro Tosi)

1
2

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 3)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.6.3-1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing