-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Nov 2026 16:08:41 +0100 Source: qpid-proton Binary: libqpid-proton-cpp12 libqpid-proton-cpp12-dbgsym libqpid-proton-cpp12-dev libqpid-proton11 libqpid-proton11-dbgsym libqpid-proton11-dev python3-qpid-proton python3-qpid-proton-dbgsym Architecture: armhf Version: 0.37.0-6+deb13u1 Distribution: trixie Urgency: medium Maintainer: armhf Build Daemon (arm-ubc-06) Changed-By: Thomas Goirand Description: libqpid-proton-cpp12 - C++ libraries for Qpid Proton libqpid-proton-cpp12-dev - C++ Development libraries for writing messaging apps with Qpid Pr libqpid-proton11 - C libraries for Qpid Proton libqpid-proton11-dev - C Development libraries for writing messaging apps with Qpid Prot python3-qpid-proton - language bindings for Qpid Proton messaging framework - Python 3. Closes: 1152779 Changes: qpid-proton (0.37.0-6+deb13u1) trixie; urgency=medium . * CVE-2026-105031: the OpenSSL TLS implementation added to rather than replaced the default system trust anchors, potentially trusting unexpected peer certificates. Applied upstream patch "PROTON-2976: Make pn_ssl_domain_set_trusted_ca_db replace the default CAs": - CVE-2026-105031_Make-pn_ssl_domain_set_trusted_ca_db-replace-the-.patch * CVE-2026-105042: a deeply nested message body decoded by pn_message_body() could overflow the stack and crash the application. Applied a minimal fix bounding the decoder nesting depth (upstream reworked the decoder in 0.41.1): - CVE-2026-105042_Limit-the-AMQP-decoder-nesting-depth.patch * CVE-2026-114230: SASL frame dispatch also dispatched AMQP frames claiming to be SASL frames, allowing authentication bypass. Applied upstream patch "PROTON-2970: Validate the SASL state before handling a frame": - CVE-2026-114230_Validate-the-SASL-state-before-handling-a-fra....patch * CVE-2026-115942: a misconfigured wildcard TLS certificate causes a stack read overflow. Applied a minimal fix rejecting wildcard patterns that cannot match without reading out of bounds (upstream enforces RFC 9525 through a full rework in 0.41.1): - CVE-2026-115942_Bound-wildcard-pattern-match-in-match_dns_pattern.patch (Closes: #1152779) * debian/control: Add python3-setuptools to Build-Depends, for the distutils shim needed by the CMake Python detection with Python 3.13. Checksums-Sha1: 569b23d4dd935f7287ca06810253838f1a2a94eb 2239208 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_armhf.deb 626766486630b5bd8c49b2df8b30fc8b7d919613 47064 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_armhf.deb 0a8bd4b336f63447d778424d9c7d2626bfa71257 102340 libqpid-proton-cpp12_0.37.0-6+deb13u1_armhf.deb 5f5819ca9e99462ff2381e3824e4e7fd1e943efa 1478148 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_armhf.deb 841be8bf35a0f901ff3c45c3ca23832b3ecd4451 76156 libqpid-proton11-dev_0.37.0-6+deb13u1_armhf.deb f1920dab127453858b3313cb0d7ba32784720ce2 214392 libqpid-proton11_0.37.0-6+deb13u1_armhf.deb 8724a9e1120a237de3b6eb70cfdfbb96e8bb948d 377876 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_armhf.deb 729eeb8e4ea210c5191df35ed0adedef84f24b46 134052 python3-qpid-proton_0.37.0-6+deb13u1_armhf.deb 14526e00c06bb66415f1112f3e525c8eb8adc16b 11798 qpid-proton_0.37.0-6+deb13u1_armhf-buildd.buildinfo Checksums-Sha256: 585afec316273d5627f0808d449b91091bae210c27590f9580a9ed9625395b75 2239208 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_armhf.deb a5dc11dceae26e1766d52e6a8a8696aa0c7d8d6ac1f7de599f958d322daf12c5 47064 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_armhf.deb 03aa291088d893f62d9acd2caa07b148c46c0275bd2b61e0aabad70bc6927e63 102340 libqpid-proton-cpp12_0.37.0-6+deb13u1_armhf.deb b19428b30d8d6a0bdf3d052aeadd34ca6f9458b645fbe36c2f1b0625b8b77711 1478148 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_armhf.deb 7d47c1a0755a4d9f04815993d82455927b034f305f4f62e7cf7366e87abd515f 76156 libqpid-proton11-dev_0.37.0-6+deb13u1_armhf.deb 7c7cc39cda8396d1091f2cc7ea71c4c98307393bd51f988ecea7a0eb929e872d 214392 libqpid-proton11_0.37.0-6+deb13u1_armhf.deb 29cafacf84f8e46aa868c8f0a4ac8a574e48fb503a5d56e3fea7a702ec76fa03 377876 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_armhf.deb 7bdcf17fa657970c1e75957e6e3243097d697d1535dac8009ad8b464273e6096 134052 python3-qpid-proton_0.37.0-6+deb13u1_armhf.deb a4b0f9f95ed8a00d70751f8f71eba9dea267dd1a0cb08ae3cb97a29ce5a3ca88 11798 qpid-proton_0.37.0-6+deb13u1_armhf-buildd.buildinfo Files: 865ed834968eb90e968bc22372fdd936 2239208 debug optional libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_armhf.deb 60314a07c2d6e5542f9d7cb433eaade7 47064 libdevel optional libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_armhf.deb b7f76e28028b589f0a77150bc1811b65 102340 libs optional libqpid-proton-cpp12_0.37.0-6+deb13u1_armhf.deb c62f5c34a304ccfa3dfb7b233a5d2929 1478148 debug optional libqpid-proton11-dbgsym_0.37.0-6+deb13u1_armhf.deb f3af5175cb9d19484f1809d173a8029d 76156 libdevel optional libqpid-proton11-dev_0.37.0-6+deb13u1_armhf.deb 26ef8b184c7de96b5a6a596a5abd6356 214392 libs optional libqpid-proton11_0.37.0-6+deb13u1_armhf.deb 361a6e7e817e533c5f0af902aed7b3c3 377876 debug optional python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_armhf.deb df3beeb29f439a9d94e33e7e92b95965 134052 python optional python3-qpid-proton_0.37.0-6+deb13u1_armhf.deb 2ec8ed38f3a98a876537ab04b5432336 11798 libs optional qpid-proton_0.37.0-6+deb13u1_armhf-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEBOUsBrtd5lcy6oRfutMAkCxKbL0FAmr3pRUACgkQutMAkCxK bL2h8Q/+MwfGqKi3QOPyNGDoFiOW4XwsgFntmNCPu67nqq8wi184AwRLgKUWCFZx M2S60dpU6bfUOnlDY3rWf85LPhEYdP+COG/S8ajkU9Nq0aFuQ9HjdhsyzzQkWTY7 BpMLgpMYCO8Ep5+kLluxyhvo8x9OxdB77iwjIb0imXNDwfU/qTaY3l4BxcCNdS1c LMQb8HQ3Yly9ETr8cFPSitASx4DZ8rJPxJp6bLUPeuCLC3jjCJ/+VtZX1ZXHiqhh vkmd8tc4nKlCzDxNYEcCesDRVfTZGgS0G9XRp+abR0jY4ZJpt0SJDfcqvGt8eHhO DKkZGOIdQsA1iZu2nsxHBEr0D+0IHlx1HU5t9DGseF7vHw5tYl1/acnK4T6m8zMu qpSOnwQkiGtlvMsME9quVzJszSWrGVUyXAh0ICcjc2lE4BrmgqJDZIqHCs+vXbzT udV7o1rI/abuygAEGQn+Zv2YK66ta6r4POGoiMLOm3NtiKs7Ae3tC2cz0eh9VO9s YxlOP6swyWYVsQzid8qOwoc60A2km5WqmKXDPwoLiFpkqhYwjN5uuFjWroH3nhab QveJi9AvtPFtz/DIhPpiaeP2SxwTTKzGJD4n623XQYe2YslBDvZ9XOxHiD3bPm9n gclOL3IsZUu8FEvyPYED4XMR7F40xhtV7IkxFw/CTdkBX3TQrGU= =yJrg -----END PGP SIGNATURE-----