[From nobody Tue Aug 25 21:31:06 2026 Received: (at 1143841-close) by bugs.debian.org; 25 Aug 2026 20:29:13 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 121; hammy, 150; neutral, 241; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:55668) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wyxlh-005XNN-0M for 1143841-close@bugs.debian.org; Tue, 25 Aug 2026 20:29:13 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wyxlg-002OBA-2K for 1143841-close@bugs.debian.org; Tue, 25 Aug 2026 20:29:12 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=7VXP8FeIcfwmyzX76D2z35o9g036diYkoEVssnd7Beg=; b=P3xnQdqQY3GfCTL3Ya8eHaDiEd 8PfsKSpDdY2c+fwliRtrh3nQGYsD4jFIybJLeu0jtwwe8nu25DMg/1p/AhXCLtrwFZVEd/Q+GuCHR 2PFQtmVNV76PgV4Lvqpm0+H7SMM4wNqO5SajlxNRHtRlOxvvN6fSVcEnzBRJVuxCfYjFOJ7RYg+Tz KTLqueMh3WQXu5VzUA/LlrbToGR1EsmoiXB6SzFeBVQKHAAT2WP/16HILmokRb+oTreRYPi0xYa53 xRXueIrog8oiMavW8RnLBFTlu3txkEMyEQALwDBf1yZFNy6LIYZRnMICJ2iodKK88mp2iXTtVR4+o 4X7WFZOw==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wyxlf-0000000FYcM-3sLk; Tue, 25 Aug 2026 20:29:11 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> To: 1143841-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: openssl Debian: DAK Debian-Changes: openssl_3.6.4-1_source.changes Debian-Source: openssl Debian-Version: 3.6.4-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1143841: fixed in openssl 3.6.4-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============1540060433529867245==" Message-Id: <E1wyxlf-0000000FYcM-3sLk@fasolo.debian.org> Date: Tue, 25 Aug 2026 20:29:11 +0000 --===============1540060433529867245== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: openssl Source-Version: 3.6.4-1 Done: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> We believe that the bug you reported is fixed in the latest version of openssl, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1143841@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Sebastian Andrzej Siewior <sebastian@breakpoint.cc> (supplier of updated open= ssl package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 25 Aug 2026 20:40:24 +0200 Source: openssl Architecture: source Version: 3.6.4-1 Distribution: unstable Urgency: medium Maintainer: Debian OpenSSL Team <pkg-openssl-devel@alioth-lists.debian.net> Changed-By: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Closes: 1143841 1144615 1145172 Changes: openssl (3.6.4-1) unstable; urgency=3Dmedium . * Import 3.6.4 - CVE-2026-18798 ("QUIC Server May Trigger Double Free When Processing INITIAL Packet") - CVE-2026-63072 ("Heap Buffer Overflow in CMS Key Unwrapping") - CVE-2026-63076 ("Invalid Pointer Dereference in CMP Server via Crafted protectionAlg") - CVE-2026-14457 ("RPK Server Signature Algorithm Selection Can Derefere= nce a Missing Certificate") - CVE-2026-54874 ("Excessive Memory Use Buffering DTLS Records for a Fut= ure Epoch") - CVE-2026-63073 ("Untrusted Sender DN Used as Format String in CMP Resp= onse Validation") - CVE-2026-63074 ("CMP Indefinite Cache Growth of ExtraCerts") - CVE-2026-63075 ("QUIC ACK-only Packet Retention Can Cause Memory Exhaustion") - CVE-2026-75803 ("AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()") (Closes: #1145172) - CVE-2026-14456 ("Unbounded Memory Growth in QUIC Server Incoming Chann= el Queue") (Closes: #1144615) - CVE-2026-54876 ("Client-Side Memory Leak in OCSP Response Checking") (= Closes: #1143841) Checksums-Sha1: d2744582a6895e5259ff20eef8d9cb657b9c1ad2 2675 openssl_3.6.4-1.dsc 85aed0a4acf51f2e0d448310fd61099acf4d100a 55003802 openssl_3.6.4.orig.tar.gz 987e36db37d0fcb54cd8a34fffa0259c90fb5cef 931 openssl_3.6.4.orig.tar.gz.asc e667314305cb4504a1ab9f9c7c7b28e16ded1e6b 51852 openssl_3.6.4-1.debian.tar.xz Checksums-Sha256: c300906132d616fcce9b704f026fe2b15a83407c1b955914f0f8fe1dbb98b1af 2675 openss= l_3.6.4-1.dsc 9bffaa1ad1e07b354c21bd3324ec02fa15579f45a7d0494b3e74bc449b7333ef 55003802 op= enssl_3.6.4.orig.tar.gz 2f957d2a61971714d256a6ed58a1336a687ee19859538514763f880aa89877de 931 openssl= _3.6.4.orig.tar.gz.asc 79b60079960546d53abe36a93b52c93a965af8ea8c814d59f3865bbb5ebc1371 51852 opens= sl_3.6.4-1.debian.tar.xz Files: 3fe339af785ae55358a60ea19dd6dd62 2675 utils optional openssl_3.6.4-1.dsc f771f53e0ce36d806d64e15f4d3a36d3 55003802 utils optional openssl_3.6.4.orig.= tar.gz 92607567a7850af08af082a3ff639bd4 931 utils optional openssl_3.6.4.orig.tar.g= z.asc fbf687970996cb670773a19166a0c392 51852 utils optional openssl_3.6.4-1.debian= .tar.xz -----BEGIN PGP SIGNATURE----- iQGzBAEBCgAdFiEEV4kucFIzBRM39v3RBWQfF1cS+lsFAmqN9pwACgkQBWQfF1cS +luPHgv/TBeXuNXafQCkFy7ncYHsPRS/lXgVjWU0Fzto1xzAJ3LGC7iMuWDex4Y+ 5TeW78JTidVw1Yh3g2i/290IJwFgNHPI6gX+l01IFVhRbEX0rhFBCsIZDGLZ9qbf sqwRxSKTMZYj9oXXV8DKtrx8eExNeixUuEzvQBHwukZ4Ta90uPtPi4okcAYAYDkz +to8+gUc6KJNW1BCFUDpC7AOPDHFNznEx1+NhjsO2Hm9r5LX8ag6r8s8fbtjr6Mb KPCltrLE8yvHcYRjjL7zLSW5s947dryHDVFyQbZlkfrawXme6bcBIji2jxnyrn2C r0JNLHknfuZQe3Yrbsn9uJoQsuhR7ObgpE8SUPct36RlBfWEgGFkP57SqZxGx5xn GyChfVLwMgvwYUn11pfdP5xdthqQDhPG18pLmDnr0f7AuLrPVcInn3QLBYCd1BbN 4P3RJItAH9XPNBehpXd61Sa/ts3BfnqZjFk+piThUbJn3cm46rk3dN2RxpP/ve+p sX5yqSog =3Dpgn/ -----END PGP SIGNATURE----- --===============1540060433529867245== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCao37FwAKCRCb9qggYcy5 IdBrAP9YSdTtC4L6ch3ArTJWAHMpd+pivCpu4ofP/8SFa5xEXAEArdPPp40ftpjQ Ka24j0etsjo7t6FI8/cfd+msVPuxpQ0= =pM+T -----END PGP SIGNATURE----- --===============1540060433529867245==-- ]