-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 10 Nov 2026 16:08:41 +0100
Source: qpid-proton
Architecture: source
Version: 0.37.0-6+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1152779
Changes:
 qpid-proton (0.37.0-6+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-105031: the OpenSSL TLS implementation added to rather
     than replaced the default system trust anchors, potentially
     trusting unexpected peer certificates. Applied upstream patch
     "PROTON-2976: Make pn_ssl_domain_set_trusted_ca_db replace the
     default CAs":
     - CVE-2026-105031_Make-pn_ssl_domain_set_trusted_ca_db-replace-the-.patch
   * CVE-2026-105042: a deeply nested message body decoded by
     pn_message_body() could overflow the stack and crash the
     application. Applied a minimal fix bounding the decoder nesting
     depth (upstream reworked the decoder in 0.41.1):
     - CVE-2026-105042_Limit-the-AMQP-decoder-nesting-depth.patch
   * CVE-2026-114230: SASL frame dispatch also dispatched AMQP frames
     claiming to be SASL frames, allowing authentication bypass.
     Applied upstream patch "PROTON-2970: Validate the SASL state
     before handling a frame":
     - CVE-2026-114230_Validate-the-SASL-state-before-handling-a-fra....patch
   * CVE-2026-115942: a misconfigured wildcard TLS certificate causes a
     stack read overflow. Applied a minimal fix rejecting wildcard
     patterns that cannot match without reading out of bounds (upstream
     enforces RFC 9525 through a full rework in 0.41.1):
     - CVE-2026-115942_Bound-wildcard-pattern-match-in-match_dns_pattern.patch
     (Closes: #1152779)
   * debian/control: Add python3-setuptools to Build-Depends, for the
     distutils shim needed by the CMake Python detection with Python 3.13.
Checksums-Sha1:
 be65cc4b34b4a6b08bac2f5ff0a0dc9218c116f7 2852 qpid-proton_0.37.0-6+deb13u1.dsc
 3bd7ffb330b41cd0cfcb9212692b6d56cade26a0 12596 qpid-proton_0.37.0-6+deb13u1.debian.tar.xz
 2063fc1cf8c213756b29a869a802d69635be0b6c 13593 qpid-proton_0.37.0-6+deb13u1_amd64.buildinfo
Checksums-Sha256:
 ae18c0e74972b1c9a3192bf5bb02d15ee295b6c97817803a68fff479f2f653c9 2852 qpid-proton_0.37.0-6+deb13u1.dsc
 a184ce2a6dab5bf53336bda6de0e99bec775fa4061507e33d027b78e91572cb3 12596 qpid-proton_0.37.0-6+deb13u1.debian.tar.xz
 b6182262472af9614f88cab7b0d12745e74f7572fc553da708e411d61cda8bc7 13593 qpid-proton_0.37.0-6+deb13u1_amd64.buildinfo
Files:
 51c57171ca8a9b70281d919a921e9153 2852 libs optional qpid-proton_0.37.0-6+deb13u1.dsc
 a08516d96cf5cb473047f078e7fb67d7 12596 libs optional qpid-proton_0.37.0-6+deb13u1.debian.tar.xz
 611c233567f6db6ce9e500c867668ee8 13593 libs optional qpid-proton_0.37.0-6+deb13u1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrzOEEACgkQ1BatFaxr
Q/5Uew/7B8TzBd83QwNpEizxbZGrFeE9Ig8raepxvdKf/CGudttQG6jjyN/OzKki
1Sx3kBfKN47EjjeHx22LzKJaUQkdjHItLoSvIFDgBcSxNNsSu8kkYO791PapiqsB
36k6FFtmcrBxPP3Hrn0+e0NGnLtFjtsCFhQMqcwATnbmJ26IJDKL1kBzDzlFpzrw
bI66WoCtIrBOrobGASkeuSgXbsCk9Mg2xKs5dFnX0soHvkwvytQQHRdloZfVYINE
UfaD/uf3I9AzqdOTRggWYZO+MfmVZwqspk2krHSYeUM1Nutp7YrVXs7X6drpKh+q
GhapjvSVWU5pSm2JxcNGy+r1qUCRn9wlbn6L5niBhpl4a1eNBbOlOy/wQ2egNvJw
yn7KWxZHzuGORaRNI/IAAv0RQV9xviD4BAUHc/YCEpeCVD3RXkTq/vOK64HmSooR
wg9DR3CN3UCchA4aok3hbg20XkgDmq7tTp2zgldxd60L/qoBf30q9+Ah3RQmwjRx
Z679/vEqF7D/W+RpD9qCdQN/ENzn0Se/qHqdcfaDfP1Su3eTryBbEEqltB2hDZtv
0dT7Brsu0DKhWYPbzoeUjqxS5x1tRWhID548ErXdFrOf7ER7cJ/8zUX96alJMN4A
UTNnVmh4Fo5BMLGtt1Fz93BLnRgtLZLWS3E7Cmq9HOSoGtEdzSw=
=jCvP
-----END PGP SIGNATURE-----