[From nobody Wed Aug 26 19:48:07 2026 Received: (at 1144615-close) by bugs.debian.org; 26 Aug 2026 18:47:08 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 78; hammy, 150; neutral, 285; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:34880) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wzIeS-009NXt-12 for 1144615-close@bugs.debian.org; Wed, 26 Aug 2026 18:47:08 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wzIeR-003PP8-3D for 1144615-close@bugs.debian.org; Wed, 26 Aug 2026 18:47:08 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=J8zy2XwA+yDkdICbyyn+E5rEIl+ZZfc5nH3hB67aAg4=; b=L/r3+Oa3vJ56rs73lAqCYA0x9d 3USnC5GXgnh/JrD2tV4Su7CDFQiSHyVaOHcAYxv5jPf8vnjQEYilXc0BrfrKF7kAaPtO2NTV0hAkk 1OpqfGSMHD8vtpX7dUzTHJp5dDKBj+ZAv+fh49EXf736ggX/v3WOf5bxLVKAp6n4aGv/cAyifsyLs BrOxAAMhr2za2YkMt0BkAWvWmJceLYdYj0Ja7syoeEqk2o+4V/GbEvr2kSuoIOMYwJ6MkGFj0A9gE tGz/cWnDZv/yX/J/nF5nLVRwz+bca58uEPx+SaAYI0ZcLX2utPN/QdzADE+FKiS+2pT0dkOSkxbIB vbLP6Tsw==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wzIeR-00000001pV4-0zt7; Wed, 26 Aug 2026 18:47:07 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> To: 1144615-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: openssl Debian: DAK Debian-Changes: openssl_3.5.7-1~deb13u2_source.changes Debian-Source: openssl Debian-Version: 3.5.7-1~deb13u2 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1144615: fixed in openssl 3.5.7-1~deb13u2 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============8785896037492164684==" Message-Id: <E1wzIeR-00000001pV4-0zt7@fasolo.debian.org> Date: Wed, 26 Aug 2026 18:47:07 +0000 X-CrossAssassin-Score: 2 --===============8785896037492164684== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: openssl Source-Version: 3.5.7-1~deb13u2 Done: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> We believe that the bug you reported is fixed in the latest version of openssl, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1144615@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Sebastian Andrzej Siewior <sebastian@breakpoint.cc> (supplier of updated open= ssl package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 17:26:22 +0200 Source: openssl Architecture: source Version: 3.5.7-1~deb13u2 Distribution: trixie-security Urgency: medium Maintainer: Debian OpenSSL Team <pkg-openssl-devel@alioth-lists.debian.net> Changed-By: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Closes: 1144615 1145172 Changes: openssl (3.5.7-1~deb13u2) trixie-security; urgency=3Dmedium . * CVE-2026-18798 ("QUIC Server May Trigger Double Free When Processing INITIAL Packet") * CVE-2026-63072 ("Heap Buffer Overflow in CMS Key Unwrapping") * CVE-2026-63076 ("Invalid Pointer Dereference in CMP Server via Crafted protectionAlg") * CVE-2026-14457 ("RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate") * CVE-2026-54874 ("Excessive Memory Use Buffering DTLS Records for a Future Epoch") * CVE-2026-63073 ("Untrusted Sender DN Used as Format String in CMP Respon= se Validation") * CVE-2026-63074 ("CMP Indefinite Cache Growth of ExtraCerts") * CVE-2026-63075 ("QUIC ACK-only Packet Retention Can Cause Memory Exhaustion") * CVE-2026-75803 ("AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()") (Closes: #1145172) * CVE-2026-14456 ("Unbounded Memory Growth in QUIC Server Incoming Channel Queue") (Closes: #1144615) Checksums-Sha1: 3ca57150dc1772933fd41379d021de9a77b83de9 2707 openssl_3.5.7-1~deb13u2.dsc 53d331880fbde8e6fe25870d5325a61201f6264d 53153930 openssl_3.5.7.orig.tar.gz 9408998095f984b36591732286ef1df1ba7ce492 833 openssl_3.5.7.orig.tar.gz.asc 6d1177d59ef985cff4b6baef95ae748ec724af12 74836 openssl_3.5.7-1~deb13u2.debia= n.tar.xz Checksums-Sha256: 25904642004d30c5c3da4642a72a7d09f8d9eb6e5ce62dab53c0371114faf8f2 2707 openss= l_3.5.7-1~deb13u2.dsc a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8 53153930 op= enssl_3.5.7.orig.tar.gz d3d082bee3f658c31db53af625eceecf29d777c7010394bed5787ebcc98abdf2 833 openssl= _3.5.7.orig.tar.gz.asc 593a47654ead460a3b609503733f80bef552ff0802799d3b47784faacc50809f 74836 opens= sl_3.5.7-1~deb13u2.debian.tar.xz Files: 81887cbcbcfffb723ad8f7dcfdcaef70 2707 utils optional openssl_3.5.7-1~deb13u2= .dsc 36608cd5445f708d0c2200aea9682c35 53153930 utils optional openssl_3.5.7.orig.= tar.gz 1550a37dc3382ec617b5fd7d4140b92c 833 utils optional openssl_3.5.7.orig.tar.g= z.asc 1345084467bf31d9c7caf40647744577 74836 utils optional openssl_3.5.7-1~deb13u= 2.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQGzBAEBCgAdFiEEV4kucFIzBRM39v3RBWQfF1cS+lsFAmqLE+4ACgkQBWQfF1cS +ls/WgwAmzlbjcsP6qMq6l4IPgT2VHHG69FRWTJbnELXQ2dnrnknBJR9P/qjq00M qV302bCH0ryaCYZAfWfYIiYwvTU+pP43iqjpTRKjENh0UDSgx5FiSWn+6i2Jcbl6 QCvx1oJY+1GsGxDoblIoG/hOXwyX8h2T2o3aA+F+rc3A5gJlEm3+GrauE3oM5KRP UiJCK9yX194VyweZdV3gJmAUzhQ/DhZz2z+a6dMZuaJsTf0ZKtPGL2DLKT7DVHtt EscEOLKZO96i/6QU4OQDjkLN+RVZ7rsA/uqXqvbnfKqFcEYqOD7WfM/T8ItKi26/ ZvBv23SlhiKbgvRmyJhz5j6F1V9qCrId1dGoGRS2H4cPuxobyFHat1ohbFXJxBxf RTAc7uFGhgZMebvfFNJj0sc55U1dIqwXQb5ZoyLZPRdUIQYUcYtydoEgA1q6OvnX qqtDwqjvhSW6P7uvlX9/fFi9k3mE1ihKtBu4rkk3wOUVaOFsBSWIrKjysM0LWqiE EdZMkxL9 =3DeCc/ -----END PGP SIGNATURE----- --===============8785896037492164684== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCao80qwAKCRCb9qggYcy5 IZFnAQDgiUsii++30ZQrG7fyBFv/eDLcoeRp1HA37tJcKCo9pQEA6+y9rLr4yjLq OM/nWVN+VBxOSMZkLyyJyZn4/vbWZQ8= =ArRv -----END PGP SIGNATURE----- --===============8785896037492164684==-- ]