[From nobody Mon Sep 28 09:19:16 2026 Received: (at submit) by bugs.debian.org; 19 Apr 2026 11:38:39 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,FOURLA,HAS_PACKAGE,MD5_SHA1_SUM,SPF_HELO_NONE,SPF_PASS, X_DEBBUGS_CC autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 16; hammy, 124; neutral, 28; spammy, 2. spammytokens:0.869-+--Inc, 0.848-+--inc hammytokens:0.000-+--HX-Debbugs-Cc:sk:debian-, 0.000-+--U*debian-security, 0.000-+--debian-security@lists.debian.org, 0.000-+--debiansecuritylistsdebianorg, 0.000-+--H*F:D*disroot.org Return-path: <james_montgomery@disroot.org> Received: from layka.disroot.org ([178.21.23.139]:52108) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <james_montgomery@disroot.org>) id 1wEQU2-001itJ-09 for submit@bugs.debian.org; Sun, 19 Apr 2026 11:38:39 +0000 Received: from mail01.disroot.lan (localhost [127.0.0.1]) by disroot.org (Postfix) with ESMTP id 35BE5273EA for <submit@bugs.debian.org>; Sun, 19 Apr 2026 13:38:34 +0200 (CEST) X-Virus-Scanned: SPAM Filter at disroot.org Received: from layka.disroot.org ([127.0.0.1]) by localhost (disroot.org [127.0.0.1]) (amavis, port 10024) with ESMTP id zL0SEEq6mbkh for <submit@bugs.debian.org>; Sun, 19 Apr 2026 13:38:33 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=disroot.org; s=mail; t=1776598713; bh=ccyEkHV2nk2j3BhQl9ich1DDMoji774jzZsDUmzvbFk=; h=Date:From:To:Subject; b=fDPl+e46lwuwzK5Z8t3fFcW2Ai4dSSdMHmBNpizzkYu9qeDmuPYuoyyqRoff546Eb jleMdSf2BDwF8mLVqOmSY4ftDVDDj6Q69LRmP8slLXcwPFqEkjVcEcHlCkQQz2nNyW 3eHHZG05QUT7EfQCsKCNC69dakR3cYj2Dap6eQORzs1nGo6S4btzkIqQMYthEw7DY4 dW15KC3WIlMT3MvvqWASYCLWyiOb8oOENeuaf7KjyT5nJVgp/HyK/pwghh45+wdDdp 4SoXQvn73i7aiNJZnVE1VIlFLgKOf9oo5V5oWFlpT4iFmzvpwsqnPt3yTy7/W8RO1o pl0edZH7nM6TQ== Date: Sun, 19 Apr 2026 11:38:31 +0000 Message-ID: <dc913139c5dccb95a4a2ad095145ccaf@disroot.org> From: James Montgomery <james_montgomery@disroot.org> To: submit@bugs.debian.org Subject: bouncycastle: CVE-2026-5598: timing channel in FrodoKEM X-Debbugs-Cc: debian-security-tracker@lists.debian.org Delivered-To: submit@bugs.debian.org Package: bouncycastle Version: 1.80-3 Severity: important Tags: security upstream User: debian-security@lists.debian.org Usertags: CVE-2026-5598 Dear Maintainer, The following vulnerability was published for bouncycastle. CVE-2026-5598[1]: | Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. | BC-JAVA core on all (core modules). Non-constant time comparisons risk | private key leakage in FrodoKEM. Upstream lists BC 1.71 through 1.83 as affected and BC 1.84 as fixed[2]. The current Debian package in stable/testing/unstable is 1.80-3, which is within that affected range. The upstream fix appears to be: https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87 [1] https://www.cve.org/CVERecord?id=CVE-2026-5598 [2] https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598 Regards, James ]