-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Nov 2026 16:08:41 +0100 Source: qpid-proton Binary: libqpid-proton-cpp12 libqpid-proton-cpp12-dbgsym libqpid-proton-cpp12-dev libqpid-proton11 libqpid-proton11-dbgsym libqpid-proton11-dev python3-qpid-proton python3-qpid-proton-dbgsym Architecture: arm64 Version: 0.37.0-6+deb13u1 Distribution: trixie Urgency: medium Maintainer: arm64 Build Daemon (arm-ubc-05) Changed-By: Thomas Goirand Description: libqpid-proton-cpp12 - C++ libraries for Qpid Proton libqpid-proton-cpp12-dev - C++ Development libraries for writing messaging apps with Qpid Pr libqpid-proton11 - C libraries for Qpid Proton libqpid-proton11-dev - C Development libraries for writing messaging apps with Qpid Prot python3-qpid-proton - language bindings for Qpid Proton messaging framework - Python 3. Closes: 1152779 Changes: qpid-proton (0.37.0-6+deb13u1) trixie; urgency=medium . * CVE-2026-105031: the OpenSSL TLS implementation added to rather than replaced the default system trust anchors, potentially trusting unexpected peer certificates. Applied upstream patch "PROTON-2976: Make pn_ssl_domain_set_trusted_ca_db replace the default CAs": - CVE-2026-105031_Make-pn_ssl_domain_set_trusted_ca_db-replace-the-.patch * CVE-2026-105042: a deeply nested message body decoded by pn_message_body() could overflow the stack and crash the application. Applied a minimal fix bounding the decoder nesting depth (upstream reworked the decoder in 0.41.1): - CVE-2026-105042_Limit-the-AMQP-decoder-nesting-depth.patch * CVE-2026-114230: SASL frame dispatch also dispatched AMQP frames claiming to be SASL frames, allowing authentication bypass. Applied upstream patch "PROTON-2970: Validate the SASL state before handling a frame": - CVE-2026-114230_Validate-the-SASL-state-before-handling-a-fra....patch * CVE-2026-115942: a misconfigured wildcard TLS certificate causes a stack read overflow. Applied a minimal fix rejecting wildcard patterns that cannot match without reading out of bounds (upstream enforces RFC 9525 through a full rework in 0.41.1): - CVE-2026-115942_Bound-wildcard-pattern-match-in-match_dns_pattern.patch (Closes: #1152779) * debian/control: Add python3-setuptools to Build-Depends, for the distutils shim needed by the CMake Python detection with Python 3.13. Checksums-Sha1: f4dd5594d505219cb1ce54c30a3d43764e3745a9 2253364 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_arm64.deb 02116e2c3c4f7966827a9fe1ac58bb390f75d0bb 47056 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_arm64.deb 5a7f7a7cebaa95a740f48a73cc91ebfa592d502a 105952 libqpid-proton-cpp12_0.37.0-6+deb13u1_arm64.deb 5293f9ba1104f84fd0c786c8921767961aa9cd83 1448164 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_arm64.deb df84130a9a495f22bb710664acf0a421ff329392 76152 libqpid-proton11-dev_0.37.0-6+deb13u1_arm64.deb 71c8af00f61d5310e8871494acbb1b57c83dc592 236112 libqpid-proton11_0.37.0-6+deb13u1_arm64.deb eb02b74cfe5f1c6c3047ba1f2be8e563a355b4ac 367556 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_arm64.deb 9ec04d3f0e9498a50584b5d318b6cbf45d3582ac 137480 python3-qpid-proton_0.37.0-6+deb13u1_arm64.deb 2925607f9bd6f3b54e903061b653048a478385aa 11916 qpid-proton_0.37.0-6+deb13u1_arm64-buildd.buildinfo Checksums-Sha256: 04cf52ae6acff3cedba8be946b26ed4d66523da5d92b4bebac5ca819bcb6ae8e 2253364 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_arm64.deb ccfd25a7bff462ea543890b211e49a006480bd464d17c3520072dcc0379bf488 47056 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_arm64.deb c1a0d72d6b7a88c0b53ea7d4f63286e12a28439e9e8145061b53e5cd8c25053b 105952 libqpid-proton-cpp12_0.37.0-6+deb13u1_arm64.deb 23f1ba12d831824470bae330884dca7adefaa660eff6f7303e9a0fc7ce39dd52 1448164 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_arm64.deb 4a92cd4a6818bd8604708d292eef7d2c18b83b8d45a8ace042f13f3a70969542 76152 libqpid-proton11-dev_0.37.0-6+deb13u1_arm64.deb 14f6138dcd93a6947506cf843df63af89188c7e8fcdb1e5aabe0e87dc53430ba 236112 libqpid-proton11_0.37.0-6+deb13u1_arm64.deb dad223125c60bffcc6d5a4b8d856517588e455970d8cc90d56cd7ac4862eb6d9 367556 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_arm64.deb cfee95d918d9abafc4e3fdde093d843425ccda929eafc8a87bde53fccface548 137480 python3-qpid-proton_0.37.0-6+deb13u1_arm64.deb bed2bb2f0b38b9b97d55ae550b7613149e2c3a1f1a752bca9481b688624519f4 11916 qpid-proton_0.37.0-6+deb13u1_arm64-buildd.buildinfo Files: 4a3a7b9cf237838798e10974f828a46d 2253364 debug optional libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_arm64.deb c8a9fd935b7a14bc684bd23bb37bf49c 47056 libdevel optional libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_arm64.deb e1bb949d4cd2d0adf8d327d6dddcaf1f 105952 libs optional libqpid-proton-cpp12_0.37.0-6+deb13u1_arm64.deb 37337a1b140701eefc76ad1740daa515 1448164 debug optional libqpid-proton11-dbgsym_0.37.0-6+deb13u1_arm64.deb d0620ab33cbb5c36cb461552ae543650 76152 libdevel optional libqpid-proton11-dev_0.37.0-6+deb13u1_arm64.deb c8cd3489ddf744a0be259f7a48affd9f 236112 libs optional libqpid-proton11_0.37.0-6+deb13u1_arm64.deb 25611c7b5cc1798ac5d95bfe616e08d6 367556 debug optional python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_arm64.deb 6ef1fdd9ca30efb2edcda342a62b4e66 137480 python optional python3-qpid-proton_0.37.0-6+deb13u1_arm64.deb d2986038e7c74f60df9bf116a932b825 11916 libs optional qpid-proton_0.37.0-6+deb13u1_arm64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7rv+l3KtZdQea77lnwznazfjXToFAmr3pQ4ACgkQnwznazfj XTo08RAAwllPpbT2RvRly5LWUOk2kQe75iKbhpeJghRFuZ4ee7BsT/1jZpZNAcCA HSAWri8Dfh+piWOZzb1tMv3IIlLp/05eV2oDl4chc31Kl8Lrd2A9wd5WJFgGIv0J N8UrznXMSsJzf/o+jdWpGyY7d02B0S/IJYxXESCbfyVgDR6UZWshRWdANvwswL58 DJUlxD7dHvRoOvscOcr6YLu7s9kG8YlovRZXdqkAoIFmW7v3ejpd/K9lrLHX4iTf 9rnn3Wu333jy1U5OC3W3NoJFH5UbybHgsgJJV82ITzn75+WLSTjVWT79A2ebUq3u /53VpZfLee9O4yTnx5thdVj9b6dGvdzbyu4W2P1qsCboX/m2nlUSz5qt1v0AR9WN ZhRlIhCYFcItj7rTP7mP1FdF5O98GsWN25dQ51KLXNkA9WkqBxU5tNbQWnZYVea7 rRT4ndnvEw8pZ3aC712DNNO1Mqhz/WZKB+ZXvAjs4ky8FrIAmJl3VsZgrsxUIGfw P0KdnVELCCrIQtitY6HrhbUcHYvuW0A/E8a/wV2D4UuWB52XrU146lCEYNhudlTd qTlBLAE7LOHQ5OxDaBL/HfGnCjn6WAbcWcGvGBBmXOghVG65ARlUcUNjJLBwIMeT 9ASHiH9nd1euVHqa0Md7pbsy2giAFBgo+ZHhVzg5KOt5yudPMdY= =es4G -----END PGP SIGNATURE-----