QSN-8712-1: pyasn1 vulnerabilities
2026-09-01

Summary:
Several security issues were fixed in pyasn1.

Details:
It was discovered that pyasn1 did not properly bound the size of long-form
tag identifiers when parsing BER, CER, or DER encoded data. An attacker
could possibly use this issue to cause applications decoding untrusted
ASN.1 data to consume excessive CPU resources, resulting in a denial of
service. (CVE-2026-59884)

It was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID
values in quadratic time relative to the number of arcs. An attacker could
possibly use this issue to cause applications decoding untrusted ASN.1 data
to consume excessive CPU resources, resulting in a denial of service.
(CVE-2026-59885)

It was discovered that pyasn1 incorrectly handled conversion of decoded
REAL values to Python float types. An attacker could possibly use this
issue to cause applications decoding untrusted ASN.1 data to consume
excessive CPU and memory resources, resulting in a denial of service.
(CVE-2026-59886)

Affected QuantaStor releases:
  6.9.1.001 jammy: python3-pyasn1 0.4.8-1ubuntu0.3 (fixed in 0.4.8-1ubuntu0.3)
  6.9.0.464 jammy: python3-pyasn1 0.4.8-1ubuntu0.3 (fixed in 0.4.8-1ubuntu0.3)
  6.8.6.015 jammy: python3-pyasn1 0.4.8-1ubuntu0.3 (fixed in 0.4.8-1ubuntu0.3)
  6.8.5.018 jammy: python3-pyasn1 0.4.8-1ubuntu0.2 (fixed in 0.4.8-1ubuntu0.3)
  6.8.4.038 jammy: python3-pyasn1 0.4.8-1ubuntu0.2 (fixed in 0.4.8-1ubuntu0.3)
  6.8.3.018 jammy: python3-pyasn1 0.4.8-1ubuntu0.2 (fixed in 0.4.8-1ubuntu0.3)
  6.8.2.002 jammy: python3-pyasn1 0.4.8-1ubuntu0.2 (fixed in 0.4.8-1ubuntu0.3)
  6.8.1.007 jammy: python3-pyasn1 0.4.8-1ubuntu0.2 (fixed in 0.4.8-1ubuntu0.3)
  6.8.0.205 jammy: python3-pyasn1 0.4.8-1ubuntu0.2 (fixed in 0.4.8-1ubuntu0.3)

CVEs: CVE-2026-59885, CVE-2026-59886, CVE-2026-59884

References:
  https://ubuntu.com/security/notices/USN-8712-1