-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Nov 2026 16:08:41 +0100 Source: qpid-proton Binary: libqpid-proton-cpp12 libqpid-proton-cpp12-dbgsym libqpid-proton-cpp12-dev libqpid-proton11 libqpid-proton11-dbgsym libqpid-proton11-dev python3-qpid-proton python3-qpid-proton-dbgsym Architecture: amd64 Version: 0.37.0-6+deb13u1 Distribution: trixie Urgency: medium Maintainer: amd64 / i386 Build Daemon (x86-ubc-02) Changed-By: Thomas Goirand Description: libqpid-proton-cpp12 - C++ libraries for Qpid Proton libqpid-proton-cpp12-dev - C++ Development libraries for writing messaging apps with Qpid Pr libqpid-proton11 - C libraries for Qpid Proton libqpid-proton11-dev - C Development libraries for writing messaging apps with Qpid Prot python3-qpid-proton - language bindings for Qpid Proton messaging framework - Python 3. Closes: 1152779 Changes: qpid-proton (0.37.0-6+deb13u1) trixie; urgency=medium . * CVE-2026-105031: the OpenSSL TLS implementation added to rather than replaced the default system trust anchors, potentially trusting unexpected peer certificates. Applied upstream patch "PROTON-2976: Make pn_ssl_domain_set_trusted_ca_db replace the default CAs": - CVE-2026-105031_Make-pn_ssl_domain_set_trusted_ca_db-replace-the-.patch * CVE-2026-105042: a deeply nested message body decoded by pn_message_body() could overflow the stack and crash the application. Applied a minimal fix bounding the decoder nesting depth (upstream reworked the decoder in 0.41.1): - CVE-2026-105042_Limit-the-AMQP-decoder-nesting-depth.patch * CVE-2026-114230: SASL frame dispatch also dispatched AMQP frames claiming to be SASL frames, allowing authentication bypass. Applied upstream patch "PROTON-2970: Validate the SASL state before handling a frame": - CVE-2026-114230_Validate-the-SASL-state-before-handling-a-fra....patch * CVE-2026-115942: a misconfigured wildcard TLS certificate causes a stack read overflow. Applied a minimal fix rejecting wildcard patterns that cannot match without reading out of bounds (upstream enforces RFC 9525 through a full rework in 0.41.1): - CVE-2026-115942_Bound-wildcard-pattern-match-in-match_dns_pattern.patch (Closes: #1152779) * debian/control: Add python3-setuptools to Build-Depends, for the distutils shim needed by the CMake Python detection with Python 3.13. Checksums-Sha1: c17b2e60436b547995fbd003984179cfde587003 2303304 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_amd64.deb 4157c9cdb91548e5d2f0814ce807016023bceea3 47052 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_amd64.deb bcfdcca88a9892bba86c263dedaf8e70caa67da0 119808 libqpid-proton-cpp12_0.37.0-6+deb13u1_amd64.deb 96d2ef2e2a8c3970e5ba2f80424c09a0b5e4fdef 1500568 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_amd64.deb a394e0b6998116dbbbfd9ee40d2b01c9db985d82 76148 libqpid-proton11-dev_0.37.0-6+deb13u1_amd64.deb 96fe92a6d5fde6dffb89106fc01b1594de5fd9c7 261324 libqpid-proton11_0.37.0-6+deb13u1_amd64.deb 4993e4b2248b8f3767a27b7262ae88db088b2dfe 328936 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_amd64.deb ce09ee06c9f3096661a41e35296d3407941c0ae8 139928 python3-qpid-proton_0.37.0-6+deb13u1_amd64.deb ac3ce37426a971390f6052f474fea4f24fe2d383 11932 qpid-proton_0.37.0-6+deb13u1_amd64-buildd.buildinfo Checksums-Sha256: 2d48984373c545c98669ad599d46971d5e130accc72ac38b413b64189ccd2306 2303304 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_amd64.deb c1591fd0b4fc5c3053c244d0985c8ad3435af14d938093e1d009e3d0e9c50d70 47052 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_amd64.deb a0ef4f39298d1ebb1e8b96dced19884adfa481f1e05ef13dbd25e75268362f09 119808 libqpid-proton-cpp12_0.37.0-6+deb13u1_amd64.deb dcb6639889e2604a24815a4ea29362d9be86d05a7fef103f64e765f8eaa924dc 1500568 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_amd64.deb 8114c566af78f9fa9b80d76a439db3c43c0d5c1733a74480617b102c4e04b928 76148 libqpid-proton11-dev_0.37.0-6+deb13u1_amd64.deb 69e30e395883477a058020c53ad27667828361b3d028ff19c4d09e0de6d2e0cf 261324 libqpid-proton11_0.37.0-6+deb13u1_amd64.deb 9aad37eda9673b87bf3461cfd6c266b7f757ea07f2d79a01f8c5a79fc8ae944c 328936 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_amd64.deb e7df69d63f766c48d9764405cf62d003a9f28137a8e8238d51cc8925590c72e6 139928 python3-qpid-proton_0.37.0-6+deb13u1_amd64.deb 6c10ebfe28b381de427a15f20d61b56c665e5aaf4521687dc2d157c17d1124e2 11932 qpid-proton_0.37.0-6+deb13u1_amd64-buildd.buildinfo Files: cb1ecedbc9fee69908696c469040fc8c 2303304 debug optional libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_amd64.deb f2890d6e3ee757862055d8adf58c70cf 47052 libdevel optional libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_amd64.deb 8698af87f47119e52d150637760a0285 119808 libs optional libqpid-proton-cpp12_0.37.0-6+deb13u1_amd64.deb d864b0d13e7fba2c490300a2d1d63879 1500568 debug optional libqpid-proton11-dbgsym_0.37.0-6+deb13u1_amd64.deb 312bcaad856bf8cfb45971e49435a828 76148 libdevel optional libqpid-proton11-dev_0.37.0-6+deb13u1_amd64.deb 3a423049c91c69a566526285fc4cc16c 261324 libs optional libqpid-proton11_0.37.0-6+deb13u1_amd64.deb 0d150c56871806c5244026e06044f470 328936 debug optional python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_amd64.deb 84db236c45b7029a1930dc5b3c0e6a7d 139928 python optional python3-qpid-proton_0.37.0-6+deb13u1_amd64.deb a3a1e1e3482d8de2963bee388444a94b 11932 libs optional qpid-proton_0.37.0-6+deb13u1_amd64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEb5EwsJvHBEjqIJYIbheoBegwXLIFAmr3pQ8ACgkQbheoBegw XLJl2xAAmd4EzfQQ/aU/Y/NGGkEhj1WZ439YIjOb5sOFr0KRHr5f9vLGRvcGTXeU CSDmxKAu8R32asljjoop/WpmrlziHfQpRdwo+Vp2BXvhquk/rsa1DfebjhX9Ed0Z HY19Z/pDWaynNz+bjXVo0ghSfXpSkw49PncM19CUOFrIAUMBrQ0g2j2koc0CAsgb KJsThpvCexmtS+zXw5QlJIfI/WPPKmsXBueuGjG3MMcY4WRHWuCtTzo6pGwnqEa3 oL7E6gUiEjOs2AHP6NKqEm/qYXxEL6JlRytii+DGUz02r7zwp4d+XYAeFrHPd1u2 SOxFsuqGBByFu42eeqKP5AXG2OC5EJY8WWFruV0BgAciaq/RBR8tPqcqBksBefTj s5f5Sjt2KkSJkYWoyKAsGjNiU9dr76etvZrGNrKPejMs6GGfB1/lFhGx03eAzhET cu1aVMEmo8m9QO7PUfahCN6SvjOAwZejgqfhKtGb7MqjptTZL6vteBLQfneNtqT+ 56mSeFegXL7L91Ms1MbkQeyalqp9nu1dIgmOiIjexOI3tTlQm3kxCdiPFQdU0Pm+ XWCUonYPsnQ4097npYIqY9TG8Xt5LhtNaJzTVlyunmSrNqx9EmQVfic4TOF/M5hB Z89Rm8jJAvV+rTbcNbPh+59hxxWRb5Rn17tchLjIc59vf3rs1Sg= =Rqhx -----END PGP SIGNATURE-----