-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Nov 2026 16:08:41 +0100 Source: qpid-proton Binary: libqpid-proton-cpp12 libqpid-proton-cpp12-dbgsym libqpid-proton-cpp12-dev libqpid-proton11 libqpid-proton11-dbgsym libqpid-proton11-dev python3-qpid-proton python3-qpid-proton-dbgsym Architecture: i386 Version: 0.37.0-6+deb13u1 Distribution: trixie Urgency: medium Maintainer: all / amd64 / i386 Build Daemon (x86-conova-02) Changed-By: Thomas Goirand Description: libqpid-proton-cpp12 - C++ libraries for Qpid Proton libqpid-proton-cpp12-dev - C++ Development libraries for writing messaging apps with Qpid Pr libqpid-proton11 - C libraries for Qpid Proton libqpid-proton11-dev - C Development libraries for writing messaging apps with Qpid Prot python3-qpid-proton - language bindings for Qpid Proton messaging framework - Python 3. Closes: 1152779 Changes: qpid-proton (0.37.0-6+deb13u1) trixie; urgency=medium . * CVE-2026-105031: the OpenSSL TLS implementation added to rather than replaced the default system trust anchors, potentially trusting unexpected peer certificates. Applied upstream patch "PROTON-2976: Make pn_ssl_domain_set_trusted_ca_db replace the default CAs": - CVE-2026-105031_Make-pn_ssl_domain_set_trusted_ca_db-replace-the-.patch * CVE-2026-105042: a deeply nested message body decoded by pn_message_body() could overflow the stack and crash the application. Applied a minimal fix bounding the decoder nesting depth (upstream reworked the decoder in 0.41.1): - CVE-2026-105042_Limit-the-AMQP-decoder-nesting-depth.patch * CVE-2026-114230: SASL frame dispatch also dispatched AMQP frames claiming to be SASL frames, allowing authentication bypass. Applied upstream patch "PROTON-2970: Validate the SASL state before handling a frame": - CVE-2026-114230_Validate-the-SASL-state-before-handling-a-fra....patch * CVE-2026-115942: a misconfigured wildcard TLS certificate causes a stack read overflow. Applied a minimal fix rejecting wildcard patterns that cannot match without reading out of bounds (upstream enforces RFC 9525 through a full rework in 0.41.1): - CVE-2026-115942_Bound-wildcard-pattern-match-in-match_dns_pattern.patch (Closes: #1152779) * debian/control: Add python3-setuptools to Build-Depends, for the distutils shim needed by the CMake Python detection with Python 3.13. Checksums-Sha1: 71058f2e8c1d2f0785eebf64c5c2526eff5e86b9 2264520 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_i386.deb c32ba2cd738702f256c3f79714034e45dda7e070 47048 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_i386.deb 5676a5b92ab846b6d1189f987f9be6f662403613 134136 libqpid-proton-cpp12_0.37.0-6+deb13u1_i386.deb 2501ba974c156f711491848d3708f3adfb92e1a1 1416236 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_i386.deb 4a991ae44fdf436acd54916096423d955c64a677 76144 libqpid-proton11-dev_0.37.0-6+deb13u1_i386.deb 21b6450517743eb59f4298b3bd037125ae713384 287128 libqpid-proton11_0.37.0-6+deb13u1_i386.deb 63b5997a8f555cf5727af577ef262a93a72e2983 297468 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_i386.deb 56b1aad5708b21b4c2c9c61c24e0fd57086cac0d 139564 python3-qpid-proton_0.37.0-6+deb13u1_i386.deb be241a80f1a54bdefd076d54e669360b04041547 11815 qpid-proton_0.37.0-6+deb13u1_i386-buildd.buildinfo Checksums-Sha256: 0f251b8c7b9b44e6b390a5c931d72e417250370cf9ef22773b135f5aea775a26 2264520 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_i386.deb 6480890496761b0f94b6b3cba0d19e4b7846608badd1fbabf69ef37ded59d949 47048 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_i386.deb b1df7d75dd63e2e18af98d9647ecd4696df5c207f8e659ada3237f9feb3dd513 134136 libqpid-proton-cpp12_0.37.0-6+deb13u1_i386.deb 2fe24da9e82184dfe2b7d89c1f8971d820c44bde69b353c00f01d80ae76d2fd9 1416236 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_i386.deb 0a0e60f1589de7039f6041b850d82986fd9e93f07d827a5d381ac06c453526dd 76144 libqpid-proton11-dev_0.37.0-6+deb13u1_i386.deb 2218c480de810fe0cd6471bfb2cf79958db7cec9589e532770ff4745b45c73f6 287128 libqpid-proton11_0.37.0-6+deb13u1_i386.deb eec0720b762b0799deba7dd047fb4510af930df20ec589fcdef11adf2ab9777b 297468 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_i386.deb 43dc7f294b441c5f6ae0aea4547b8c31408f185c23c35a599eeeee473cb60897 139564 python3-qpid-proton_0.37.0-6+deb13u1_i386.deb 6b18750e66ecef33bae8833e253d898f082b3aabba128cea08063e4244416408 11815 qpid-proton_0.37.0-6+deb13u1_i386-buildd.buildinfo Files: 00eb9c33e02186547ca627f15181e726 2264520 debug optional libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_i386.deb 110f546b84bb609c714f1dd83aa9d4b6 47048 libdevel optional libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_i386.deb 120222e40c5056c266592004af79111e 134136 libs optional libqpid-proton-cpp12_0.37.0-6+deb13u1_i386.deb 018ca5b66cdda7e43f1bb5ef455e5456 1416236 debug optional libqpid-proton11-dbgsym_0.37.0-6+deb13u1_i386.deb cdfee68d8288601bdee928ae80b684ee 76144 libdevel optional libqpid-proton11-dev_0.37.0-6+deb13u1_i386.deb 8cf8cf974f99b764b9a8ecddfce22ac9 287128 libs optional libqpid-proton11_0.37.0-6+deb13u1_i386.deb 4d9dffc6686a621de8216dc677f95ded 297468 debug optional python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_i386.deb 048f1e4c2634030fbbb81944a017699d 139564 python optional python3-qpid-proton_0.37.0-6+deb13u1_i386.deb 85b89abcc4b0ef342c325a6cb1a12657 11815 libs optional qpid-proton_0.37.0-6+deb13u1_i386-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE+i/sCsF3puL4e7qIGNGWmfrqILEFAmr3pREACgkQGNGWmfrq ILHlkg//Ws+a7L5HJQnKN7tD2MTtPkei1gTlUM0ty6EOph8PVaC+AdM5VaUflKWp Pl0KQNiP7/QJEmURz2TJdRLBLGIxCLx/qo1TaO0p//ISRIhrwKJqhsPbAV6daYdj izsaDrEsRj2oKCvnJcD4pbluaSmjFA3SuAcZx92COEg67ReV+LG8/M2eXuHm9SWR 4qYDAwq6sbRqWg/loG0j5wRc5aPdCkeqbeLKMEi6WUETQxC4KTE4RmLClm788501 7ZViIMtF8fvu5rOJjWV0Y5Ol4K8dwwZf7gmrXjm5gd5la7Nn9nqXPlEFy+FBHuT6 a/dIIg9sYxY64GrQPrAjRFx2VcFBrHF6u7p7s+M6D8dLZrZkJ82oqqlGou2OW88b bG8xjzoU1ScrlSgkOI+H9QtanMq9dxgMzGBaddkPRMAc9sXwqYIoJfwyvSBhgg2X IYmUjB/E/YvAL2CyQtV0BItbjbi4/f0sO6b4YRv/0EVKanhRmoT14q7eAIGTMMaX josSBuWu09uxidpU7cTopCUAcObI6YjNQV22Dc0My8WTSXeQdcrO4ky+3aUjI+ZN sh7KALwTdn+nd8TE99hSwfZ1JwbwQqX7ITyb1TeNu0Y8cRTQQ/leFuAXcMIuaOJp RFP3tLX4zprghJi2cJwDeKIpkGRxVzsu2OfeW6vUV/j977TkkPw= =XqqT -----END PGP SIGNATURE-----