-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 10 Nov 2026 16:08:41 +0100
Source: qpid-proton
Binary: libqpid-proton-cpp12-dev-doc libqpid-proton11-dev-doc libqpid-proton11-dev-examples python-qpid-proton-doc
Architecture: all
Version: 0.37.0-6+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-02) <buildd_amd64-x86-conova-02@buildd.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Description:
 libqpid-proton-cpp12-dev-doc - C++ developer documentation for Qpid Proton
 libqpid-proton11-dev-doc - Developer documentation for Qpid Proton
 libqpid-proton11-dev-examples - Example applications for writign messaging apps with Qpid Proton
 python-qpid-proton-doc - Documentation for the Python language bindings for Qpid Proton
Closes: 1152779
Changes:
 qpid-proton (0.37.0-6+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-105031: the OpenSSL TLS implementation added to rather
     than replaced the default system trust anchors, potentially
     trusting unexpected peer certificates. Applied upstream patch
     "PROTON-2976: Make pn_ssl_domain_set_trusted_ca_db replace the
     default CAs":
     - CVE-2026-105031_Make-pn_ssl_domain_set_trusted_ca_db-replace-the-.patch
   * CVE-2026-105042: a deeply nested message body decoded by
     pn_message_body() could overflow the stack and crash the
     application. Applied a minimal fix bounding the decoder nesting
     depth (upstream reworked the decoder in 0.41.1):
     - CVE-2026-105042_Limit-the-AMQP-decoder-nesting-depth.patch
   * CVE-2026-114230: SASL frame dispatch also dispatched AMQP frames
     claiming to be SASL frames, allowing authentication bypass.
     Applied upstream patch "PROTON-2970: Validate the SASL state
     before handling a frame":
     - CVE-2026-114230_Validate-the-SASL-state-before-handling-a-fra....patch
   * CVE-2026-115942: a misconfigured wildcard TLS certificate causes a
     stack read overflow. Applied a minimal fix rejecting wildcard
     patterns that cannot match without reading out of bounds (upstream
     enforces RFC 9525 through a full rework in 0.41.1):
     - CVE-2026-115942_Bound-wildcard-pattern-match-in-match_dns_pattern.patch
     (Closes: #1152779)
   * debian/control: Add python3-setuptools to Build-Depends, for the
     distutils shim needed by the CMake Python detection with Python 3.13.
Checksums-Sha1:
 5c55181aace2bfbd1a6c39b0507eaa0a1222416a 389512 libqpid-proton-cpp12-dev-doc_0.37.0-6+deb13u1_all.deb
 e89ba2bdbe21bb6d3ccbdac71ec9cddc1a3dc788 352808 libqpid-proton11-dev-doc_0.37.0-6+deb13u1_all.deb
 8ea3e378d4cced56249c6c1da8ea514232a00687 67164 libqpid-proton11-dev-examples_0.37.0-6+deb13u1_all.deb
 0d13b63fd9c686e7b70feded0add9d003eff27ab 39028 python-qpid-proton-doc_0.37.0-6+deb13u1_all.deb
 a684b207e28a60fc79a42711f3170684bbaed0bc 10620 qpid-proton_0.37.0-6+deb13u1_all-buildd.buildinfo
Checksums-Sha256:
 03d9c3b2f8b0e21a345bb1aaa5257c74bf70a803b48498d083cff8c6e11bc8fb 389512 libqpid-proton-cpp12-dev-doc_0.37.0-6+deb13u1_all.deb
 747b2cdf293a6f99d025243a1ad22017d97e68659e96c51069f7fdfd4b3d129d 352808 libqpid-proton11-dev-doc_0.37.0-6+deb13u1_all.deb
 44ad48a16f0fce675b5982ec333dc53007f39366b7f209fc09d853dab2b9ed99 67164 libqpid-proton11-dev-examples_0.37.0-6+deb13u1_all.deb
 d4e5a5746c089209875212a33fd0c1f6a73d6fa20a85046beb2afcaeba2336cf 39028 python-qpid-proton-doc_0.37.0-6+deb13u1_all.deb
 eaf831b53b670ed92e119309f6f0e83635e00967132ea7c022cb9b582edaa38f 10620 qpid-proton_0.37.0-6+deb13u1_all-buildd.buildinfo
Files:
 33dacaae15c4ba9f84abe597a1c17612 389512 doc optional libqpid-proton-cpp12-dev-doc_0.37.0-6+deb13u1_all.deb
 ee358c6f53aff03bbdeac7cf54156f6e 352808 doc optional libqpid-proton11-dev-doc_0.37.0-6+deb13u1_all.deb
 8d8ddfd54e26c66a5e0ef68e572e6d89 67164 libdevel optional libqpid-proton11-dev-examples_0.37.0-6+deb13u1_all.deb
 fcc0b0652bb3c5f899a0a8a6168f2f98 39028 doc optional python-qpid-proton-doc_0.37.0-6+deb13u1_all.deb
 42a869ce69d7bb457d92eed34c9ec97b 10620 libs optional qpid-proton_0.37.0-6+deb13u1_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE+i/sCsF3puL4e7qIGNGWmfrqILEFAmr3p50ACgkQGNGWmfrq
ILHQDw/9HQY71BlAPm5eWP7bxwRRtKrbYQmB+nV4Sx5OBcGtwTItIrzaiyr6ONAb
oF4V95dQdBoVdG5/CAvjk2Hbjr3/xUNlD+opv8KtSIPNfseJ4Sj/ALSoJylkDO2b
4C+lSso6n69xsyATum9LcN2XekhpWXG3oZQka9kYEo3NmzANQja0LrV9bGJrF2HJ
+Nst3OQcuhRIz6mqlP1dTkiwIZR3o/Hp+PNwWsj/9heFsMo6VB8I19HhVHhGmW9J
jx65oPDZ3t4ASY91pCoGZrhYmihyUwK4dDjukUg6EBpC24RjUvuRUiZNOm/+1kP5
d6xKfcluQn+mhjdY0J/qrCJcCPLfG651t4isGgHsJZef62Uv/72piKwT6VweqodJ
NImEtWEncC8F49c8ihFjSxL2zEKFj38Gto/0gIZJUbipLF1HkxftflIyPgs0/wHv
/Hod4y3pqhogDz2ZMDv3YI4pR66aDws/KYgYeZK1z/YzN1noLKi70WydCByCuxNO
/dk/V2mU02ta040Bkj9t9ePZVT46u97qPHSZThW3334ZlZswIXhWycGNDhjQlszC
et3flLKLmc8C5FQUceFG1i1jvCX1q3a1OnEBl1dXLHpe0z82Oj58139RQnkqQIXj
Io6W2hdKZ+Sx8FNncvp1qvrB72RTnNhC6ZSc5hKR3A9+Ec3vmRs=
=BfUW
-----END PGP SIGNATURE-----