-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Nov 2026 16:08:41 +0100 Source: qpid-proton Binary: libqpid-proton-cpp12 libqpid-proton-cpp12-dbgsym libqpid-proton-cpp12-dev libqpid-proton11 libqpid-proton11-dbgsym libqpid-proton11-dev python3-qpid-proton python3-qpid-proton-dbgsym Architecture: armel Version: 0.37.0-6+deb13u1 Distribution: trixie Urgency: medium Maintainer: armel Build Daemon (arm-conova-01) Changed-By: Thomas Goirand Description: libqpid-proton-cpp12 - C++ libraries for Qpid Proton libqpid-proton-cpp12-dev - C++ Development libraries for writing messaging apps with Qpid Pr libqpid-proton11 - C libraries for Qpid Proton libqpid-proton11-dev - C Development libraries for writing messaging apps with Qpid Prot python3-qpid-proton - language bindings for Qpid Proton messaging framework - Python 3. Closes: 1152779 Changes: qpid-proton (0.37.0-6+deb13u1) trixie; urgency=medium . * CVE-2026-105031: the OpenSSL TLS implementation added to rather than replaced the default system trust anchors, potentially trusting unexpected peer certificates. Applied upstream patch "PROTON-2976: Make pn_ssl_domain_set_trusted_ca_db replace the default CAs": - CVE-2026-105031_Make-pn_ssl_domain_set_trusted_ca_db-replace-the-.patch * CVE-2026-105042: a deeply nested message body decoded by pn_message_body() could overflow the stack and crash the application. Applied a minimal fix bounding the decoder nesting depth (upstream reworked the decoder in 0.41.1): - CVE-2026-105042_Limit-the-AMQP-decoder-nesting-depth.patch * CVE-2026-114230: SASL frame dispatch also dispatched AMQP frames claiming to be SASL frames, allowing authentication bypass. Applied upstream patch "PROTON-2970: Validate the SASL state before handling a frame": - CVE-2026-114230_Validate-the-SASL-state-before-handling-a-fra....patch * CVE-2026-115942: a misconfigured wildcard TLS certificate causes a stack read overflow. Applied a minimal fix rejecting wildcard patterns that cannot match without reading out of bounds (upstream enforces RFC 9525 through a full rework in 0.41.1): - CVE-2026-115942_Bound-wildcard-pattern-match-in-match_dns_pattern.patch (Closes: #1152779) * debian/control: Add python3-setuptools to Build-Depends, for the distutils shim needed by the CMake Python detection with Python 3.13. Checksums-Sha1: a68df59b165732b1c684924e965753e53a7e2a6a 2233832 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_armel.deb 1d861a0fcc8f1c0997460e865460025cf97ae5a4 47052 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_armel.deb b7af4dac8e660c8e84c54d9105c34fb4de98ebb2 100336 libqpid-proton-cpp12_0.37.0-6+deb13u1_armel.deb 2782f69a43d4c40b3304534d9e5959e21f6f3f5f 1470316 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_armel.deb 4731e2bd5e3e4f67fb746aad03da83240aaae1bd 76148 libqpid-proton11-dev_0.37.0-6+deb13u1_armel.deb e89a7ab3ec5b56271e1b26816e2c180e171ac79d 211484 libqpid-proton11_0.37.0-6+deb13u1_armel.deb 616d4b8d22605c39f6d6368197d67c3232abdfaa 374428 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_armel.deb d916b1862321f906bc91478a7f19993c5186e5a8 130864 python3-qpid-proton_0.37.0-6+deb13u1_armel.deb 25f738816b57f9a1ff5993b9a3dc8547ee0bea39 11784 qpid-proton_0.37.0-6+deb13u1_armel-buildd.buildinfo Checksums-Sha256: 931ad92c30fe1d994b976d0b8fa48a4893daf2e54a5dc6fde720abdf7d6c27d3 2233832 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_armel.deb f58f1a7aea9bb9fd0a5287da7067b3578da89bfd4a1dd31c7b30e10a52eee457 47052 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_armel.deb 0147d804ec9c173212fd14f1e2eaaf2034323f37d4f4b1caaa862b8429c03111 100336 libqpid-proton-cpp12_0.37.0-6+deb13u1_armel.deb 7f30716bddefb874437549e2a276cf12b54b10dfade954130c07870e45b0552b 1470316 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_armel.deb ca144a1d523d30ec220cd0d05c53f4364025333cccc476e9c817815c1b4180be 76148 libqpid-proton11-dev_0.37.0-6+deb13u1_armel.deb de6c1f94efc8f6da2aff8bd71f91aff91e993306e29f3bfb7c8acc4ffc9ed051 211484 libqpid-proton11_0.37.0-6+deb13u1_armel.deb e8f2267a74eb719568d60aef1e0b476a15a79579608bc41639723e49ec3ae5fc 374428 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_armel.deb a11c14ae6ee07cee2030a342f4bf160aeefc23694f07dcc279b580e93f69375b 130864 python3-qpid-proton_0.37.0-6+deb13u1_armel.deb 903d03f8088bc32e0d83fce7b8fe08481416e9a5a0d41f6271890efd5fb94dc1 11784 qpid-proton_0.37.0-6+deb13u1_armel-buildd.buildinfo Files: 8afc7c5160b192e345fbd5e12fe96931 2233832 debug optional libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_armel.deb 672c52d3addb0c717e2bb1bf95d24240 47052 libdevel optional libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_armel.deb 902173373cf19f70134bbf8e28c2c40d 100336 libs optional libqpid-proton-cpp12_0.37.0-6+deb13u1_armel.deb 465333e95dc89b1adf53a0e3f73950eb 1470316 debug optional libqpid-proton11-dbgsym_0.37.0-6+deb13u1_armel.deb f84c7bb1591984381d5343eec76fc946 76148 libdevel optional libqpid-proton11-dev_0.37.0-6+deb13u1_armel.deb f8ee2410ce5f9effbb6a06e66022c0b1 211484 libs optional libqpid-proton11_0.37.0-6+deb13u1_armel.deb 77d50ee65d251c03a502fc32b93823be 374428 debug optional python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_armel.deb 4a5dfa199755fee943ec954e583c0a03 130864 python optional python3-qpid-proton_0.37.0-6+deb13u1_armel.deb 142f842a1b7104ff6a0ffa65269f7937 11784 libs optional qpid-proton_0.37.0-6+deb13u1_armel-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEdK9iafpA71gaFfL5MLZgEo1cLWsFAmr3pQEACgkQMLZgEo1c LWu6Xg//eaj3lnFTrUsI/VOqpswZn5AX1VNY51BXFI2MHQAQPxcx/u1eXq5E4naF QAN8aqnWYLFS705cgjrhzQPSjBKS6+ETgxFzsvpc9GjGyAXEwoiTIPWhyiTRAFhF 9YFwZ13kiENAVoZUnOKvj82QRJCnh5B/YSeqY85OSXpJaOHg0peuRvrJE5UejFl+ Qi9UQtgt3FvV5EFUFVb7Dph3BlYe4JuaN+MkvJVFdwS32rM8fgx60D5SHX8u+ObX sIMja3ZyaR+wY1akdBJRHtx42Q3j0P8pPsagg+I2qLqdaxEadfORC7JAwgXVSs7s i7zlY08FN9ksaLKdGFxgvXXHpZhX2uwHwok6IFxjVh5YEZ2dn92+PK9sapmazb6j M9UmCrLDuE0kZxmAAlW3wZiuy40H4IuztIhk5AXJR32zIDg1UhmZNCaOvlVgpI/t 46eV7rseak9HjgbAMnT/feCM4FZ2qQiyMkaUMeMSzSuivZqVWyJbaZGgvM160ti9 9TDnu/s3amJU/x/PfuKht7x4AieONJAf6WcZaOLhv7FLDTXp/tMOZxKYm501pgL4 3PXikNV5N/CstRQp86A/uKhdgqicdeXVvR+KFmk63jRzmlT/9D56g/u+ct7EyyGQ faI9bKd2feimG0CDPSn5BQ30t2bkNvuGBQXZ7+GpvTuamq+HEP0= =qm3E -----END PGP SIGNATURE-----