-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Nov 2026 16:08:41 +0100 Source: qpid-proton Binary: libqpid-proton-cpp12 libqpid-proton-cpp12-dbgsym libqpid-proton-cpp12-dev libqpid-proton11 libqpid-proton11-dbgsym libqpid-proton11-dev python3-qpid-proton python3-qpid-proton-dbgsym Architecture: ppc64el Version: 0.37.0-6+deb13u1 Distribution: trixie Urgency: medium Maintainer: ppc64el Build Daemon (ppc64el-conova-01) Changed-By: Thomas Goirand Description: libqpid-proton-cpp12 - C++ libraries for Qpid Proton libqpid-proton-cpp12-dev - C++ Development libraries for writing messaging apps with Qpid Pr libqpid-proton11 - C libraries for Qpid Proton libqpid-proton11-dev - C Development libraries for writing messaging apps with Qpid Prot python3-qpid-proton - language bindings for Qpid Proton messaging framework - Python 3. Closes: 1152779 Changes: qpid-proton (0.37.0-6+deb13u1) trixie; urgency=medium . * CVE-2026-105031: the OpenSSL TLS implementation added to rather than replaced the default system trust anchors, potentially trusting unexpected peer certificates. Applied upstream patch "PROTON-2976: Make pn_ssl_domain_set_trusted_ca_db replace the default CAs": - CVE-2026-105031_Make-pn_ssl_domain_set_trusted_ca_db-replace-the-.patch * CVE-2026-105042: a deeply nested message body decoded by pn_message_body() could overflow the stack and crash the application. Applied a minimal fix bounding the decoder nesting depth (upstream reworked the decoder in 0.41.1): - CVE-2026-105042_Limit-the-AMQP-decoder-nesting-depth.patch * CVE-2026-114230: SASL frame dispatch also dispatched AMQP frames claiming to be SASL frames, allowing authentication bypass. Applied upstream patch "PROTON-2970: Validate the SASL state before handling a frame": - CVE-2026-114230_Validate-the-SASL-state-before-handling-a-fra....patch * CVE-2026-115942: a misconfigured wildcard TLS certificate causes a stack read overflow. Applied a minimal fix rejecting wildcard patterns that cannot match without reading out of bounds (upstream enforces RFC 9525 through a full rework in 0.41.1): - CVE-2026-115942_Bound-wildcard-pattern-match-in-match_dns_pattern.patch (Closes: #1152779) * debian/control: Add python3-setuptools to Build-Depends, for the distutils shim needed by the CMake Python detection with Python 3.13. Checksums-Sha1: 4df6262f1a8a9d23cb5c39f251dfcfdc2e752a13 2277088 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_ppc64el.deb bf5c4e76103cf3a727475d94ef858310314d02cb 47060 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_ppc64el.deb 455f9c4a1910b06c3451d3cce2894c719c04888b 119372 libqpid-proton-cpp12_0.37.0-6+deb13u1_ppc64el.deb 768b260faa0fa04be6cc5b85f446fbf786497645 1498120 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_ppc64el.deb 1e0a3a02ec33e37afa20e52e7c452fc22e8f6b68 76156 libqpid-proton11-dev_0.37.0-6+deb13u1_ppc64el.deb 83de23817782f896aa594f15efd20ebfcf31c504 272348 libqpid-proton11_0.37.0-6+deb13u1_ppc64el.deb ebc23fe32ac66d78a2db8e58d04d884726e47dff 381948 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_ppc64el.deb 5c716737d435898299e47011c07c3df039ca185a 141660 python3-qpid-proton_0.37.0-6+deb13u1_ppc64el.deb 03e2eb9fbf0f278c4fc39ef6e4dd82d92e2dcd4e 11967 qpid-proton_0.37.0-6+deb13u1_ppc64el-buildd.buildinfo Checksums-Sha256: 9b080847c6680ff71d24e38fe738de0e43545816a6c5f87ccd692c26e394a4c7 2277088 libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_ppc64el.deb c6dfaa4f41747d8b5f221556dd5d3da114a85f70c5d30210b9609d109f41a65f 47060 libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_ppc64el.deb 1c11858dd8deabbd30d397f924091b382a8f62518daefe2826888092f63360ed 119372 libqpid-proton-cpp12_0.37.0-6+deb13u1_ppc64el.deb 031a1f8fdc35f9c008c03acb97645d58cc9737f9b8de7fc1d1e3302f806af964 1498120 libqpid-proton11-dbgsym_0.37.0-6+deb13u1_ppc64el.deb 62732ea0db5165566ecb75a1d2116dba357feaa6e1f6306c3f0237d1b75e69b1 76156 libqpid-proton11-dev_0.37.0-6+deb13u1_ppc64el.deb 406dc6967fe869d583b7c2dc8e259228c5e75fce766a02b20b00489d51d18e4b 272348 libqpid-proton11_0.37.0-6+deb13u1_ppc64el.deb 4a736423ebf2c27f59db04300f1ce33e621ad874be95b662db7694a8c92755c0 381948 python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_ppc64el.deb 2ab91bc4f3cd48f321bcc1a7828c63752d85c9e3ae3d0867ed2114cdf2a9f8e7 141660 python3-qpid-proton_0.37.0-6+deb13u1_ppc64el.deb d52ef3e84ba6d36d266cfa3d4c362c7d4600b2142316a23570620b396528b055 11967 qpid-proton_0.37.0-6+deb13u1_ppc64el-buildd.buildinfo Files: 6661f2ec7a9bc592d777943002eea12f 2277088 debug optional libqpid-proton-cpp12-dbgsym_0.37.0-6+deb13u1_ppc64el.deb 6485a2d7e2a6e9e5cd9ab84cd92f5301 47060 libdevel optional libqpid-proton-cpp12-dev_0.37.0-6+deb13u1_ppc64el.deb 983c4a66323647e1ebfa247e3a7028f3 119372 libs optional libqpid-proton-cpp12_0.37.0-6+deb13u1_ppc64el.deb d83f6e9a10396e8a40554c3ccd092269 1498120 debug optional libqpid-proton11-dbgsym_0.37.0-6+deb13u1_ppc64el.deb 0fa305f23937da10ef1596c2c72c017b 76156 libdevel optional libqpid-proton11-dev_0.37.0-6+deb13u1_ppc64el.deb 13f888ca9e8b9e003a3d1ac80bc93e5d 272348 libs optional libqpid-proton11_0.37.0-6+deb13u1_ppc64el.deb 72204d9210628f7a327595ada39c1800 381948 debug optional python3-qpid-proton-dbgsym_0.37.0-6+deb13u1_ppc64el.deb c928db2b01bcdd41ad2682c5c6865cac 141660 python optional python3-qpid-proton_0.37.0-6+deb13u1_ppc64el.deb 4535eeebaac3e5e9010678bd7e6f66c3 11967 libs optional qpid-proton_0.37.0-6+deb13u1_ppc64el-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEDoRc43uRWMOoIqIgDNLUPhbmg7MFAmr3pQcACgkQDNLUPhbm g7O6SQ/9HUcLL18NKdOXU96c1Zfq68hX/8/7iNFiO7YAVvP4w1Fj0pYpWLLd2AGm if1De3NfhzclHqK6Oz3AQO2fpMQbFgQh+zuKQ9dbwsd9fuTM3PapEXDAcbZDEomC Rf2mX4VZXiSidLPmOTTz/AfDktXY6/um2kJ7PkGjPfIoqgUwHg7HL4uD8Ne3+r/P QWOQQF/PuJk9pxEzRx3M3c+qLkupxX80kTqzc3HCx0DDiz/K0zzFyRtlEZshXspR DiRU7iS7Eqyi6vFuhaLiXVJVef8IhdUhWclNr/3c5PWZooYKjRk1Fw48Gvx4c5Ak SpxctRoq+tFg8/eUtKj8kXOsWI9pHbi3fqVuu3ZUE7sbdIOxpY4GVQRywTHauH82 YALRhsrg/zeDSCO6Vptk1drxkAu+2Kswu0jGaq0pUVk3y9VEmfbZZDaE24C1LTmh SEOqZcQPzQVLUBrFWgU3WBPwswWPRGIJo25hPfcXEyg57tUM6sSK7vE66aPk1m/0 OyUve/pFtYGsEuTfMzS1jfUa+6RLoENbkX3Ym18Xl//PIZWagEJIRFYSjRKFOZms S3DYwutezuzFYDnfdDEmxlUm0O3tci0at+/Qs8tZKBbEaoLMF1yeEBjYhb+vuD0l av1srf1tttVlV5PFldhkbGGKa7HWBq3+tToI76CAs/Jo2ZITN8s= =yarF -----END PGP SIGNATURE-----