-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Nov 2026 16:08:41 +0100 Source: qpid-proton Binary: libqpid-proton-cpp12 libqpid-proton-cpp12-dbgsym libqpid-proton-cpp12-dev libqpid-proton11 libqpid-proton11-dbgsym libqpid-proton11-dev python3-qpid-proton python3-qpid-proton-dbgsym Architecture: s390x Version: 0.37.0-6+deb13u1 Distribution: trixie Urgency: medium Maintainer: s390x Build Daemon (zani) Changed-By: Thomas Goirand Description: libqpid-proton-cpp12 - C++ libraries for Qpid Proton libqpid-proton-cpp12-dev - C++ Development libraries for writing messaging apps with Qpid Pr libqpid-proton11 - C libraries for Qpid Proton libqpid-proton11-dev - C Development libraries for writing messaging apps with Qpid Prot python3-qpid-proton - language bindings for Qpid Proton messaging framework - Python 3. Closes: 1152779 Changes: qpid-proton (0.37.0-6+deb13u1) trixie; urgency=medium . * CVE-2026-105031: the OpenSSL TLS implementation added to rather than replaced the default system trust anchors, potentially trusting unexpected peer certificates. Applied upstream patch "PROTON-2976: Make pn_ssl_domain_set_trusted_ca_db replace the default CAs": - CVE-2026-105031_Make-pn_ssl_domain_set_trusted_ca_db-replace-the-.patch * CVE-2026-105042: a deeply nested message body decoded by pn_message_body() could overflow the stack and crash the application. Applied a minimal fix bounding the decoder nesting depth (upstream reworked the decoder in 0.41.1): - CVE-2026-105042_Limit-the-AMQP-decoder-nesting-depth.patch * CVE-2026-114230: SASL frame dispatch also dispatched AMQP frames claiming to be SASL frames, allowing authentication bypass. Applied upstream patch "PROTON-2970: Validate the SASL state before handling a frame": - CVE-2026-114230_Validate-the-SASL-state-before-handling-a-fra....patch * CVE-2026-115942: a misconfigured wildcard TLS certificate causes a stack read overflow. Applied a minimal fix rejecting wildcard patterns that cannot match without reading out of bounds (upstream enforces RFC 9525 through a full rework in 0.41.1): - CVE-2026-115942_Bound-wildcard-pattern-match-in-match_dns_pattern.patch (Closes: #1152779) * debian/control: Add python3-setuptools to Build-Depends, for the distutils shim needed by the CMake Python detection with Python 3.13. Checksums-Sha1: f9ba8083a80cf6cabde8a4f384e0d3b9bfc0d2da 2343024 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_s390x.deb dbc45f86fdae55fb7d6a998fa62dd3ea605ba529 47052 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_s390x.deb 64df0965cd9c45d8b8df10b29af8bc1f5bbdb2f0 110172 libqpid-proton-cpp12_0.37.0-6+deb13u1_s390x.deb 550af7f36ac3c91c512ef9973080b891d09fe5e6 1518000 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_s390x.deb 46246a193468e6100cc738422e3a14875d482d15 76144 libqpid-proton11-dev_0.37.0-6+deb13u1_s390x.deb 591e2ab47601cdd4b172abe3be01f44a3f653862 253844 libqpid-proton11_0.37.0-6+deb13u1_s390x.deb 69f61a9be379d22f3a453b21386119abac333fe7 361968 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_s390x.deb 9a7f7fe992deacb480e7fe4c7387082063c7f668 136420 python3-qpid-proton_0.37.0-6+deb13u1_s390x.deb bfed6256b1f16e9a78d713a8ac03616a94e2bf88 11794 qpid-proton_0.37.0-6+deb13u1_s390x-buildd.buildinfo Checksums-Sha256: 914ae56f7be5eedd16a484dfce7c3b3616bffa5644b5c538b039e52db4af789e 2343024 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_s390x.deb 264c8c4475f429ed6a5c78fa85ab3a1041dcd73ef1f1f5d2e2506cb3b95f6b7f 47052 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_s390x.deb b8e748a516d19caba20df33f0df5e9d81b40c231ee094a2207b433c612bd271c 110172 libqpid-proton-cpp12_0.37.0-6+deb13u1_s390x.deb 509e3d6c50d99a9184fa2ae6c1cbbd60f56cb28030366e3ce0f343841cf8f804 1518000 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_s390x.deb 100a1fd2984d5a92bb5e57161790deb78ead8cc1c9b63aecf583b63b7b59e58c 76144 libqpid-proton11-dev_0.37.0-6+deb13u1_s390x.deb 51aa3c31e0dbc64ef8b409d95535eaed2992b3d83821a34aa003442629175418 253844 libqpid-proton11_0.37.0-6+deb13u1_s390x.deb ce098f74587efea534f5929128b6e979c10853caeaf74a36c6dc215473b4eb95 361968 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_s390x.deb e87fbea0aaf8487ae15ce997e9ede413dc058fbc095d707afa0291c0f32973bc 136420 python3-qpid-proton_0.37.0-6+deb13u1_s390x.deb 8193172d4bf7d90847514eee90bca9c720702d229b20e12769943d719155d6da 11794 qpid-proton_0.37.0-6+deb13u1_s390x-buildd.buildinfo Files: 567b4ccbfeba1c002ec8a5fe190d3ac9 2343024 debug optional libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_s390x.deb 724fd7ccfe4c43aaf5a8264483ccca6b 47052 libdevel optional libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_s390x.deb 489ce8020a05331ef42bc0c4fc544523 110172 libs optional libqpid-proton-cpp12_0.37.0-6+deb13u1_s390x.deb 8a50d30ae52f36ffd95128f740926593 1518000 debug optional libqpid-proton11-dbgsym_0.37.0-6+deb13u1_s390x.deb e31944e2832789ed40f02e76d7b0cc39 76144 libdevel optional libqpid-proton11-dev_0.37.0-6+deb13u1_s390x.deb 61a81ddfeab2c2eb243dc8ec465975ac 253844 libs optional libqpid-proton11_0.37.0-6+deb13u1_s390x.deb 64a778b9e22ab65ce2024a9c3742843d 361968 debug optional python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_s390x.deb 2c6960c56b5d1f36b6a105db724d11d9 136420 python optional python3-qpid-proton_0.37.0-6+deb13u1_s390x.deb aa01f915effba4334e12996e746decb8 11794 libs optional qpid-proton_0.37.0-6+deb13u1_s390x-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEfUKc1SwkyxlVJBiWHOd5r2LlPicFAmr3pfgACgkQHOd5r2Ll PiehIBAAuY9nHXNb2g+GpP6IdmFPHhdRgiiA/GZ4NVlEKhtM3pVX1kM4Nzx2heHH 1WBZC3F4RDy8CTkf4RusEF3ZoOSsOLkKrMosgLkR+ehFCUHOdwclJIs4wSnowP/E xZTfIoLOe7CMWv3q5eFeFejQT+anuQ7qkx7+cpgzIrGiu+IviVZ5Vg02XmgeUw2g Zush7YuNL9ar0MXu+bmNI3/WroydSTeC5uo09Vat1aGkksnxKwM8dUOxyFkxBh+9 8nC2/ZtOEoIApHq4iH85KS5VKfCcTCdZJfzLJOqGQ9dwU5W1cUyLtHlsdB8yRKfp DNrAU+/8IusYWejhDtsHqeKDlPekAKl+1WLntQ6bh0jmWSdILkUS1J/+0YRFIQed zXv25fkDPqiAaUcvuy/e1387vFnH+FE2aWQL5gwBWFobxEdtiYO9VrTgJSgZJruY GX0TPPaHdFSXNpMiU++jksr4nvYxheHOe0dFnquwKzyRdU8Mf8oz2ArtF37JDZ00 AZlG2OKIPbz2lvRfzPkGJAsNWokkG66O5TN/NBlcvwVWV8OnHdGC2zG1e9otnbLF RY0fVGRJWOivwN9E5UD3is5j/eaAgfZOIFjqBU1ptOe5NgIFJuaf0se7BRCwfvpG wMI5wNmaGDVX7RZ+bRKdwl60IylYzvMG8cD37McyvLOydY6kyxQ= =HVrh -----END PGP SIGNATURE-----