{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": [
                "snapd"
            ]
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "python3-pyasn1"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "python3-pyasn1",
                "from_version": {
                    "source_package_name": "pyasn1",
                    "source_package_version": "0.4.8-1ubuntu0.3",
                    "version": "0.4.8-1ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "pyasn1",
                    "source_package_version": "0.4.8-1ubuntu0.4",
                    "version": "0.4.8-1ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-119197",
                        "url": "https://ubuntu.com/security/CVE-2026-119197",
                        "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-29 20:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-119196",
                        "url": "https://ubuntu.com/security/CVE-2026-119196",
                        "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-29 20:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-119194",
                        "url": "https://ubuntu.com/security/CVE-2026-119194",
                        "cve_description": "pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-29 20:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-119197",
                                "url": "https://ubuntu.com/security/CVE-2026-119197",
                                "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-29 20:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-119196",
                                "url": "https://ubuntu.com/security/CVE-2026-119196",
                                "cve_description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-29 20:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-119194",
                                "url": "https://ubuntu.com/security/CVE-2026-119194",
                                "cve_description": "pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-29 20:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: DoS via quadratic binary REAL decoding",
                            "    - debian/patches/CVE-2026-119197.patch: decode the REAL mantissa in a",
                            "      single conversion in pyasn1/codec/ber/decoder.py,",
                            "      tests/codec/ber/test_decoder.py, tests/codec/cer/test_decoder.py,",
                            "      tests/codec/der/test_decoder.py.",
                            "    - CVE-2026-119197",
                            "  * SECURITY UPDATE: DoS via quadratic constructed BIT STRING decoding",
                            "    - debian/patches/CVE-2026-119196.patch: assemble constructed BIT STRING",
                            "      fragments in linear time in pyasn1/codec/ber/decoder.py,",
                            "      tests/codec/ber/test_decoder.py, tests/codec/cer/test_decoder.py,",
                            "      tests/codec/der/test_decoder.py.",
                            "    - CVE-2026-119196",
                            "  * SECURITY UPDATE: DoS via quadratic schemaless container decoding",
                            "    - debian/patches/CVE-2026-119194.patch: stop collecting tag sets once two",
                            "      distinct types are seen in pyasn1/codec/ber/decoder.py.",
                            "    - CVE-2026-119194",
                            ""
                        ],
                        "package": "pyasn1",
                        "version": "0.4.8-1ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Charles Cochran <charles.cochran@canonical.com>",
                        "date": "Wed, 04 Nov 2026 14:17:47 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": [
            {
                "name": "snapd",
                "from_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": "28256"
                },
                "to_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": "28330"
                }
            }
        ]
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20261106 to 20261109",
    "from_series": "jammy",
    "to_series": "jammy",
    "from_serial": "20261106",
    "to_serial": "20261109",
    "from_manifest_filename": "release_manifest.previous",
    "to_manifest_filename": "manifest.current"
}