-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Nov 2026 16:08:41 +0100 Source: qpid-proton Binary: libqpid-proton-cpp12 libqpid-proton-cpp12-dbgsym libqpid-proton-cpp12-dev libqpid-proton11 libqpid-proton11-dbgsym libqpid-proton11-dev python3-qpid-proton python3-qpid-proton-dbgsym Architecture: riscv64 Version: 0.37.0-6+deb13u1 Distribution: trixie Urgency: medium Maintainer: riscv64 Build Daemon (rv-manda-03) Changed-By: Thomas Goirand Description: libqpid-proton-cpp12 - C++ libraries for Qpid Proton libqpid-proton-cpp12-dev - C++ Development libraries for writing messaging apps with Qpid Pr libqpid-proton11 - C libraries for Qpid Proton libqpid-proton11-dev - C Development libraries for writing messaging apps with Qpid Prot python3-qpid-proton - language bindings for Qpid Proton messaging framework - Python 3. Closes: 1152779 Changes: qpid-proton (0.37.0-6+deb13u1) trixie; urgency=medium . * CVE-2026-105031: the OpenSSL TLS implementation added to rather than replaced the default system trust anchors, potentially trusting unexpected peer certificates. Applied upstream patch "PROTON-2976: Make pn_ssl_domain_set_trusted_ca_db replace the default CAs": - CVE-2026-105031_Make-pn_ssl_domain_set_trusted_ca_db-replace-the-.patch * CVE-2026-105042: a deeply nested message body decoded by pn_message_body() could overflow the stack and crash the application. Applied a minimal fix bounding the decoder nesting depth (upstream reworked the decoder in 0.41.1): - CVE-2026-105042_Limit-the-AMQP-decoder-nesting-depth.patch * CVE-2026-114230: SASL frame dispatch also dispatched AMQP frames claiming to be SASL frames, allowing authentication bypass. Applied upstream patch "PROTON-2970: Validate the SASL state before handling a frame": - CVE-2026-114230_Validate-the-SASL-state-before-handling-a-fra....patch * CVE-2026-115942: a misconfigured wildcard TLS certificate causes a stack read overflow. Applied a minimal fix rejecting wildcard patterns that cannot match without reading out of bounds (upstream enforces RFC 9525 through a full rework in 0.41.1): - CVE-2026-115942_Bound-wildcard-pattern-match-in-match_dns_pattern.patch (Closes: #1152779) * debian/control: Add python3-setuptools to Build-Depends, for the distutils shim needed by the CMake Python detection with Python 3.13. Checksums-Sha1: 0f54d121ca953bf45f5475246b2f182f2d4ab2e8 2030164 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_riscv64.deb 5e20f0b284a8166688b26b79ef8ad6140fd05420 47060 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_riscv64.deb 745b5a0ecc6fc3dd472b35b420d0cea19b464efa 115412 libqpid-proton-cpp12_0.37.0-6+deb13u1_riscv64.deb cba1f5aba72ebb6dd110db2fe538b9818ea6d299 1375028 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_riscv64.deb b160c8d8751f1b38ff626f0a1d5e21890a69d28e 76152 libqpid-proton11-dev_0.37.0-6+deb13u1_riscv64.deb ded91f68432278c0519c4855f43a1ec4f5d80412 257200 libqpid-proton11_0.37.0-6+deb13u1_riscv64.deb cd80c4b76ce5777054d177fe0319b7053ce3a127 328896 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_riscv64.deb bf0a7e232b4693e38d59904d27ac2eb3a4dcaacf 141464 python3-qpid-proton_0.37.0-6+deb13u1_riscv64.deb 084a046ce922189142399ec52e39d7baaca23d94 11912 qpid-proton_0.37.0-6+deb13u1_riscv64-buildd.buildinfo Checksums-Sha256: 4f700e52fd2844bb3e792c312df355d7e95f8253b7991ecaf033cbf9ace84ba0 2030164 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_riscv64.deb f5b1a3b772dea47de4ffc80c38940308c67339d803605b9c6abae572487e0d81 47060 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_riscv64.deb 3709d494bc0bd85b7febec55f9a7137b11a2d2599c2cbdd94d70352fa68923c9 115412 libqpid-proton-cpp12_0.37.0-6+deb13u1_riscv64.deb c44ec51a480c5d797792a4e67b2a7a48bc11196d0a078c55e60dcef40523da7f 1375028 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_riscv64.deb 7132d9667cd3a65983ece59f72474571ba62c61602bae5a2cbc33604ba57d411 76152 libqpid-proton11-dev_0.37.0-6+deb13u1_riscv64.deb 3921b083a766667aa560b5982cbd6a84e9de51d6dd733be233735e49b5a55c59 257200 libqpid-proton11_0.37.0-6+deb13u1_riscv64.deb 49e4319262b8087d9beddc2667b79ae50ede56934b58f6f467646c46addc32fe 328896 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_riscv64.deb 1d07d4af43c4f01225be1741b33e4ff485222056431af0f5ac934bfbcbb34db3 141464 python3-qpid-proton_0.37.0-6+deb13u1_riscv64.deb ecf23a73c63e27ee41471056e0a1af7318b5003bc9e9cf7a98dd1108a69649bb 11912 qpid-proton_0.37.0-6+deb13u1_riscv64-buildd.buildinfo Files: 083ed088d31c006e803becf1dd4e3a07 2030164 debug optional libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_riscv64.deb 6604ef12bbdfe1d79974c8e38fd540a1 47060 libdevel optional libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_riscv64.deb e00e7e89b6f08e51ac8422fa2ea9a5db 115412 libs optional libqpid-proton-cpp12_0.37.0-6+deb13u1_riscv64.deb de1c76f62cf23db085c4ffc25cd91b22 1375028 debug optional libqpid-proton11-dbgsym_0.37.0-6+deb13u1_riscv64.deb 17df7ed3eba68b8c6399ad772a755cf4 76152 libdevel optional libqpid-proton11-dev_0.37.0-6+deb13u1_riscv64.deb e197e7ff335f0ac954afa65243f4e20e 257200 libs optional libqpid-proton11_0.37.0-6+deb13u1_riscv64.deb b4a3983e108076b851f672d4abf18a35 328896 debug optional python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_riscv64.deb 083e45e5dcae7c7c1aa5080c5250350d 141464 python optional python3-qpid-proton_0.37.0-6+deb13u1_riscv64.deb 2c979ed9f02de644fb3a762cffcb1909 11912 libs optional qpid-proton_0.37.0-6+deb13u1_riscv64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEckWcgW/UYsXlW9tIY8xd4TxhvSAFAmr3s6UACgkQY8xd4Txh vSC3FA/+IFEsLoU4P/T+20qgYhMqIIb9CKaPJJaDgPIuQXioBIXW8q0rzYsuk297 MtKgRjlKNMKuatno36L18Old72OsjAbXjFi5C/kaxW0+YMVx8ztrJprDcKeauvbu KKrZjDOr2SAg+ZkGD+y3vySazr4sOlXiR4yqHdZPOL/QMs+ONisdGrTQDiYJU6Lo buqtBwUxsBo2IQV/Mi0hthIny2GF4sgkYV495O1DpG4bhwr2Fvnq/XyEeqA8L2bq heI/qobtCd0aNAoeyd2BtTP6nemjbGWL1F/GexUqJOc7CEz5/CAhpUV2TucqeoZo JVcjfSa5nIBj1lCd/yiVH4hulBN3GscyQpc+c5Uo5jgRt5k5PWX+5xW4GJaH7iMX MIWiPFdbJioeM8pTi0NK2AuJjeKyZhmWqhwDNrlILL9Ph58h3XorTxuDyuUJsA83 uz6V5ns37uESzkhaNYlag08PjJqzxyoedrAmKnqzvZYBYnzO8iffpt1kUGkDCgKw dFeRR3DLwsg+/kUYWz8nfHSV8yPSZeN8k5uqfq9L/GIg37XwNTtyInta30ACxAQK 4qbhBV1Ln9JnKSBmvUkiyPlyTC5ilXyN7wDVRluBBCCHnB8TZ5v0gnFhyiRk5cDV HWAiqGfgu5McODWocoJtx3h0JdEJzjkaUJWeyvVJveaxrmqN204= =Rtgg -----END PGP SIGNATURE-----