From d6eee4c66ddf11128cceda4237071d331cf10280 Mon Sep 17 00:00:00 2001 From: Luis Tomas Bolivar Date: Wed, 15 Jul 2026 09:19:02 +0200 Subject: [PATCH] fix: bump pyasn1 >= 0.6.4 to remediate CVE-2026-59885 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pyasn1 < 0.6.4 has quadratic-time OID decoding/encoding that allows denial of service via crafted ASN.1 payloads. Pulled in transitively via google-auth → pyasn1-modules → pyasn1. Added pyasn1>=0.6.4 as a direct dependency floor in pyproject.toml and regenerated all lock files (0.6.3 → 0.6.4). Co-Authored-By: Claude Opus 4.6 (1M context) --- pyproject.toml | 2 ++ requirements-agent.txt | 10 ++++++---- requirements-dev.txt | 10 ++++++---- requirements-handler.txt | 10 ++++++---- 4 files changed, 20 insertions(+), 12 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 355ca1b6..3cf8a23d 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -43,6 +43,8 @@ dependencies = [ "redis>=5.0.0", # Structured JSON logging with proper value escaping (CWE-117 safe) "python-json-logger>=3.0.0", + # CVE-2026-59885: pyasn1 < 0.6.4 OID decoding quadratic time DoS + "pyasn1>=0.6.4", ] [project.optional-dependencies] diff --git a/requirements-agent.txt b/requirements-agent.txt index 52a0d99c..27fb1c24 100644 --- a/requirements-agent.txt +++ b/requirements-agent.txt @@ -1736,10 +1736,12 @@ psycopg2-binary==2.9.12 \ --hash=sha256:fb1828cf3da68f99e45ebce1355d65d2d12b6a78fb5dfb16247aad6bdef5f5d2 \ --hash=sha256:ffdd7dc5463ccd61845ac37b7012d0f35a1548df9febe14f8dd549be4a0bc81e # via lightspeed-agent (pyproject.toml) -pyasn1==0.6.3 \ - --hash=sha256:697a8ecd6d98891189184ca1fa05d1bb00e2f84b5977c481452050549c8a72cf \ - --hash=sha256:a80184d120f0864a52a073acc6fc642847d0be408e7c7252f31390c0f4eadcde - # via pyasn1-modules +pyasn1==0.6.4 \ + --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \ + --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b + # via + # lightspeed-agent (pyproject.toml) + # pyasn1-modules pyasn1-modules==0.4.2 \ --hash=sha256:29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a \ --hash=sha256:677091de870a80aae844b1ca6134f54652fa2c8c5a52aa396440ac3106e941e6 diff --git a/requirements-dev.txt b/requirements-dev.txt index 68241993..af3920da 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -973,10 +973,12 @@ py-serializable==2.1.0 \ --hash=sha256:9d5db56154a867a9b897c0163b33a793c804c80cee984116d02d49e4578fc103 \ --hash=sha256:b56d5d686b5a03ba4f4db5e769dc32336e142fc3bd4d68a8c25579ebb0a67304 # via cyclonedx-python-lib -pyasn1==0.6.3 \ - --hash=sha256:697a8ecd6d98891189184ca1fa05d1bb00e2f84b5977c481452050549c8a72cf \ - --hash=sha256:a80184d120f0864a52a073acc6fc642847d0be408e7c7252f31390c0f4eadcde - # via pyasn1-modules +pyasn1==0.6.4 \ + --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \ + --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b + # via + # lightspeed-agent (pyproject.toml) + # pyasn1-modules pyasn1-modules==0.4.2 \ --hash=sha256:29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a \ --hash=sha256:677091de870a80aae844b1ca6134f54652fa2c8c5a52aa396440ac3106e941e6 diff --git a/requirements-handler.txt b/requirements-handler.txt index 3f807371..b21fb594 100644 --- a/requirements-handler.txt +++ b/requirements-handler.txt @@ -535,10 +535,12 @@ psycopg2-binary==2.9.12 \ --hash=sha256:fb1828cf3da68f99e45ebce1355d65d2d12b6a78fb5dfb16247aad6bdef5f5d2 \ --hash=sha256:ffdd7dc5463ccd61845ac37b7012d0f35a1548df9febe14f8dd549be4a0bc81e # via lightspeed-agent (pyproject.toml) -pyasn1==0.6.3 \ - --hash=sha256:697a8ecd6d98891189184ca1fa05d1bb00e2f84b5977c481452050549c8a72cf \ - --hash=sha256:a80184d120f0864a52a073acc6fc642847d0be408e7c7252f31390c0f4eadcde - # via pyasn1-modules +pyasn1==0.6.4 \ + --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \ + --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b + # via + # lightspeed-agent (pyproject.toml) + # pyasn1-modules pyasn1-modules==0.4.2 \ --hash=sha256:29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a \ --hash=sha256:677091de870a80aae844b1ca6134f54652fa2c8c5a52aa396440ac3106e941e6