[Debian-iot-maintainers] mbedtls_3.6.7-2_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 21 Jul 2026 15:47:33 -0300
Source: mbedtls
Architecture: source
Version: 3.6.7-2
Distribution: unstable
Urgency: low
Maintainer: Debian IoT Maintainers <debian-iot-maintainers at alioth-lists.debian.net>
Changed-By: Andrea Pappacoda <tachi at debian.org>
Changes:
 mbedtls (3.6.7-2) unstable; urgency=low
 .
   * Retry upload after merging the NMUs. Thanks Adrian!
   * Add fixed CVEs in the previous changelog entry
   * d/.symbols: add new 3.6.7 symbols
 .
 mbedtls (3.6.7-1) unstable; urgency=low
 .
   * New upstream version 3.6.7
     - CVE-2026-25832: TLS 1.3 client accepts HelloRetryRequest selecting an
       unadvertised group
     - CVE-2026-35336: Possible buffer overflow in mbedtls_ecdh_calc_secret()
     - CVE-2026-49300: X.509 CA bit forgery via invalid basicConstraints extension
     - CVE-2026-50579: Use-after-free in mbedtls_pkcs7_free() when reusing a
       PKCS7 context
     - CVE-2026-50580: Remote buffer overflow in TLS 1.2 ECDHE-PSK client
       handshake
     - CVE-2026-50581: Extended master secret calculation failure ignored
     - CVE-2026-50583: Out-of-bounds read when parsing a zero-length ECC
       public key
     - CVE-2026-50584: ChaCha20 counter overflow can reuse keystream
     - CVE-2026-50585: Incomplete context reset in mbedtls_ssl_session_reset()
     - CVE-2026-50586: Information disclosure in TLS 1.2 NewSessionTicket
     - CVE-2026-50587: Timing side-channel in RSA PKCS#1 v1.5 decryption
     - CVE-2026-50588: Out-of-bounds read in TLS 1.2 EC J-PAKE
       ServerKeyExchange parsing
     - CVE-2026-50640: Ignored TLS 1.3 resumption secret derivation error
     - CVE-2026-50713: Heap corruption with early renegotiation after corrupted
       record in DTLS
     - CVE-2026-54435: Side channel leak in ECC optimized modp
     - CVE-2026-54441: Signature algorithm restrictions not enforced on
       certificate chain
   * Upload with git-debpush's experimental pristine-tar support
Checksums-Sha1:
 75971ce953240408d3d0d2dd0e3cbd22816deed6 2716 mbedtls_3.6.7-2.dsc
 2edfcf2e421a31bd473e77c4dbfe3a0def7cdc71 19632 mbedtls_3.6.7-2.debian.tar.xz
 db4b3cfddc7fb5a66958ecffe5b46a064201ec45 11698340 mbedtls_3.6.7-2.git.tar.xz
 74317462cca52e2d662941f2fa85b9c9ff48e55e 17546 mbedtls_3.6.7-2_source.buildinfo
 e892e98cff90cf7e0736c525bf357626a2513c4c 5473689 mbedtls_3.6.7.orig.tar.bz2
Checksums-Sha256:
 f54b53628ca85066b4f2b65568b66f9bed96747747defa420991636825ff06cb 2716 mbedtls_3.6.7-2.dsc
 c91bdce7fb84c260b017151e0f8311d904c3bdd84174f9e5a38c6ecd679301ff 19632 mbedtls_3.6.7-2.debian.tar.xz
 1218b539a9d3119915e0ee76d45c432a77c3f363a824631a5493e456562bdc42 11698340 mbedtls_3.6.7-2.git.tar.xz
 babb7a75fd5517b9c62ffdbb3f59d066f0be2a2dd044e6128fa4d99dd5fe1a5e 17546 mbedtls_3.6.7-2_source.buildinfo
 a7e8bcbec0e6f761b4af24f25677626b35f762f68eef79c08677a363212d11f6 5473689 mbedtls_3.6.7.orig.tar.bz2
Files:
 22552c2d7907786c9d5c74df4fa88c37 2716 libs optional mbedtls_3.6.7-2.dsc
 6c32373dea8831c3e2cbf90ea450fae3 19632 libs optional mbedtls_3.6.7-2.debian.tar.xz
 57392f2f6cc417e1fc136656491d4e8c 11698340 libs optional mbedtls_3.6.7-2.git.tar.xz
 109e2b1de63923d31d7719fb57989fd5 17546 libs optional mbedtls_3.6.7-2_source.buildinfo
 d207524bd8f9dfb5fbf7f4a1997e636f 5473689 libs optional mbedtls_3.6.7.orig.tar.bz2
Git-Tag-Info: tag=94c23ac12ddd2d0e878103d80dbf5d3248a2df41 fp=ba56e348bd94451edec970074a9208a2455077a7
Git-Tag-Tagger: Andrea Pappacoda <tachi at debian.org>

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmpfz6MACgkQYG0ITkaD
wHmq4RAAu3lj5ajPOUzjojg7sFIPaLbUH6J77bKX6VoW0Ol4yLO9DOm0UdXDpI8p
vsdwcyHiczNUdb+sWYibDekkp/5n1AkNmddKst671ZdFwC8EI1i3d2Dzfiz4FZMw
NoO2lIX4xMBFzq67i9Xl53iS3KkHyM8VK2j+nEVyOUUMHDRhzpm1NQOGjsj+afcF
0CX8mGw3oBVpEY1PKyKTyp2AA41OKU0Oo1eIbgcoMSsC5S/HiJdZLzKlCCo9nwt8
I9d+qC8DDPMy9MRNVHUzxQlcPmxTvN50D5Hsl3U6826EG/hkOhen/aPFoegT/2Gw
/w/oy+yteNjER/Hc3rbtx061+KTn5XXqXnNdLd5ciXZUEnsbvBt9Zvxsrf9w1At9
rAWdVJiEKbofVgZsQ3n8eLAA9E6Y+bNUmsYcZsZ0/iESrQz1vEggOeRHJlX1QXH5
m9eim0ZOI0aJQmFS3uRQv5yEw+hUcvSWu3+q8oAVRWaab9ng/qvBPH2M3CTahMDj
GT8MYtJQuqsqcevuTTlMO0oGwQ/7U+77OUUCBepkpAxeadfugx8DJ9Nw0fCmlswo
nWQshu/h6YXNiB8j1bMth4G5tAz8T8LvIPiGBk3qFWkhdefvrjI6qAYroIMUVjRG
4NcR5X6sCzwv0pQZ9gJwqsUcUnOrdOHCEOrtamA+8SVoo2fLnFY=
=8Qig
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/debian-iot-maintainers/attachments/20260721/b0f8516c/attachment.sig>