Skip to content

Upgrading pyasn1 0.1 to 0.2

Breaking0.1.9 → 0.2.3Breaking3Security3New9Changed13Fixed11Other6

Full comparisonBack to pyasn1
BreakingUpgrade verdict

3 breaking changes and 3 security fixes.

In plain terms
  • Type checking on constructed types is now controlled by separate flags, so code relying on verifyConstraints to gate these checks may behave differently.
  • Containers are now iterable, which can change behavior for code that overrides __getitem__() or iterates a SEQUENCE expecting components.
  • Looping over a SEQUENCE now gives its keys, not its components.
  • A decoder that should only accept data with a defined length could also accept data with an indefinite length, which is a security weakness.
Must act Top 5 of 6 that need code or config changes

What you must change

Breaking3
Setter methods for constructed types now accept independent matchTags and matchConstraints flags instead of tying checks to verifyConstraints.
matchTagsmatchConstraintsverifyConstraints
0.2.3CHANGES.rstSummarizedView source
Implements iterator protocol for all container types, which may break code overriding __getitem__() or iterating SEQUENCE for components.
__getitem__()__iter__()SEQUENCE
0.2.1CHANGES.rstSummarizedView source
Iterating a SEQUENCE object now yields keys instead of components.
SEQUENCE
0.2.1CHANGES.rstSummarizedView source
Security3
Fixes a security weakness where define length only decoders could process indefinite length serialisation.
0.2.2CHANGES.rstSummarizedView source
Fixes a security weakness where canonical decoders (CER/DER) could consume non-canonical variations of valid serialisation.
0.2.2CHANGES.rstSummarizedView source
Fixes a security weakness where the BER decoder improperly cached long tags.
BER decoder
0.2.1CHANGES.rstSummarizedView source