GHSA-9M75-VC3G-4X39 pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding

Summary In pyasn1 0.6.4 and earlier, decoding a constructed OCTET STRING or character string made of many fragments can spend disproportionate CPU time repeatedly copying the accumulated value. A separate indefinite-length ANY path has the same problem while collecting the encoded components. The...