Repository navigation
fix(python-pyasn1): upgrade to 0.6.5 to address CVEs - #19981
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the python-pyasn1 update.
No open issues 🎉
What changed in this PR
Upgrades Azure Linux’s python-pyasn1 package from 0.6.4 to 0.6.5 to address the four CVEs listed in the PR.
Changes:
- Moves the component into a dedicated configuration pinned to a Fedora f43 commit.
- Refreshes the lock and source checksum for version 0.6.5.
- Updates the rendered spec’s version, release, and upstream changelog.
| File | Description |
|---|---|
specs/p/python-pyasn1/sources |
Replaces the 0.6.4 archive checksum with 0.6.5. |
specs/p/python-pyasn1/python-pyasn1.spec |
Updates to version 0.6.5, release 6, and adds the upstream changelog entry. |
locks/python-pyasn1.lock |
Records the new upstream commit and refreshed input hashes. |
base/comps/python-pyasn1/python-pyasn1.comp.toml |
Adds the documented Fedora f43 commit pin. |
base/comps/components.toml |
Removes the inline entry now defined in the dedicated configuration. |
Review effort: Balanced
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Kanishk Bansal (Kanishk-Bansal)
added
security
CVE-fixed-by-upgrade
Bump the Fedora f43 dist-git pin to python-pyasn1-0.6.5: https://src.fedoraproject.org/rpms/python-pyasn1/c/e7952688478c36abaacc8116b25a8ea200baf2cf Addresses 4 CVE(s): CVE-2026-119194, CVE-2026-119195, CVE-2026-119196, CVE-2026-119197 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
a5580ab to
0bf5848
Compare
| Version: 0.6.4 | ||
| Release: 5%{?dist} | ||
| Version: 0.6.5 | ||
| Release: 6%{?dist} |
There was a problem hiding this comment.
Question(non-blocking): Maybe a bug in azldev? shouldn't this be 1?
There was a problem hiding this comment.
This is actually correct in how azldev currently does calculations. It increments the base Release value with the "number of commits on the lock file's input-fingerprint", which in this case is +5. Agree it is odd and a deviation from normal RPM convention. There is work in progress to address this in azldev.
| # Pin to Fedora f43 python-pyasn1-0.6.5 to pick up upstream CVE fixes. | ||
| # https://src.fedoraproject.org/rpms/python-pyasn1/c/e7952688478c36abaacc8116b25a8ea200baf2cf | ||
| [components.python-pyasn1] | ||
| spec = { type = "upstream", upstream-commit = "e7952688478c36abaacc8116b25a8ea200baf2cf" } |
There was a problem hiding this comment.
issue (blocking): please use the full format for specifying which fedora release this is pulled from.
There was a problem hiding this comment.
I was asked to do so in #19970 (comment)
There was a problem hiding this comment.
I had given guidance to many reviewers to add this blocking comment, but given that we don't have a clear policy outlined one way or the other, we'll not block on this. There is an internal discussion on this to determine what the policy should be.
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Christopher Co (christopherco)
left a comment
Christopher Co (christopherco)
left a comment
There was a problem hiding this comment.
lgtm
Summary
Upgrade
python-pyasn1from 0.6.4 → 0.6.5 by bumping the Fedora f43 dist-git pin toe7952688478c.CVEs addressed (4)
CVEs not addressed by this upgrade (0)
None — all open Astrolabe CVEs for this package are addressed.
Changes
base/comps/python-pyasn1/python-pyasn1.comp.toml: pinupstream-commit = e7952688478c…(Fedora f43)locks/python-pyasn1.lock: refreshed viaazldev comp update -p python-pyasn1specs/p/python-pyasn1/: re-rendered (Version 0.6.4 → 0.6.5, Release 5%{?dist} → 6%{?dist})Testing
azldev comp build -p python-pyasn1(x86_64): success (3 RPMs); test results:============================= 1261 passed in 2.78s =============================ldd: nonot found)azldev comp render/comp updateidempotent on the committed state; commit message passes commitizen