[Pkg-openssl-devel] openssl_3.6.5-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 29 Sep 2026 21:39:32 +0200
Source: openssl
Architecture: source
Version: 3.6.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenSSL Team <pkg-openssl-devel at alioth-lists.debian.net>
Changed-By: Sebastian Andrzej Siewior <sebastian at breakpoint.cc>
Changes:
 openssl (3.6.5-1) unstable; urgency=medium
 .
   * Import 3.6.5
     - CVE-2026-84782 ("DTLS Retransmits Handshake Messages From a Stale Buffer
       Offset")
     - CVE-2026-35189 ("Memory Allocation in Relative CRLDP Processing")
     - CVE-2026-35191 ("QUIC Unvalidated Amplification Credit may be Over
       Accounted")
     - CVE-2026-42772 ("Potential CPU DoS via O(n^2) Fragment Reassembly in
       QUIC")
     - CVE-2026-54872 ("Timing Side-Channel in Scalar Multiplication for Non-NIST
       EC Curves")
     - CVE-2026-54873 ("QUIC STREAM Fragment Metadata DoS")
     - CVE-2026-54875 ("Non-Constant-Time SM2 Scalar Multiplication on ARM64 and
       RISC-V")
     - CVE-2026-72897 ("Out-of-Bounds Access After SSL_set_SSL_CTX() During a
       Handshake")
     - CVE-2026-75804 ("QUIC Connection-Level Flow Control is Not Enforced for
       Streams")
     - CVE-2026-75805 ("NULL Pointer Dereference in CMP Client Revocation
       Response Handling")
     - CVE-2026-75806 ("Unauthenticated and Undersized DTLS 1.2 AEAD Record
       Causes DoS")
     - CVE-2026-77696 ("Timing Side-Channel in SM2 Signature Generation")
     - CVE-2026-84784 ("QUIC: Unbounded RETIRE_CONNECTION_ID Backlog")
Checksums-Sha1:
 515d9acae56aa36d6f0f82154d7c014452b1f5ee 2675 openssl_3.6.5-1.dsc
 89256e2bf2e5c761c9b4c49925d816f0e3b25fe4 55078161 openssl_3.6.5.orig.tar.gz
 786526396deda6be892ee0ec1d65d172f872b0fc 931 openssl_3.6.5.orig.tar.gz.asc
 9cc7314ed0802cf11deb74b302567010963eb5b2 52240 openssl_3.6.5-1.debian.tar.xz
Checksums-Sha256:
 94f49bd74c6dd95facafca0ccb36aaf738c19cb3cd13c4073838b9b26141ed97 2675 openssl_3.6.5-1.dsc
 a2157c2830efdec3788939b00c9b0638306d3f0bbb76dc4832ee503bb397df98 55078161 openssl_3.6.5.orig.tar.gz
 85b3e373c1e1f94f6f043a4774377d04e752549c33c0f84b9f417a78b90c2372 931 openssl_3.6.5.orig.tar.gz.asc
 d0c62de0e6ad123327a40af6f7f214abf409b13e291ffe5e1dcc9a83f25e4e22 52240 openssl_3.6.5-1.debian.tar.xz
Files:
 98610ec9fe44a1b2cd5ecadb2d8aea3d 2675 utils optional openssl_3.6.5-1.dsc
 e1df3c3fea55e3dc8bcb6b422f436fbc 55078161 utils optional openssl_3.6.5.orig.tar.gz
 2a22d0411def29510b37aca34e866e9b 931 utils optional openssl_3.6.5.orig.tar.gz.asc
 11a100b7502c9f4f5a333173ff1052bd 52240 utils optional openssl_3.6.5-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEEV4kucFIzBRM39v3RBWQfF1cS+lsFAmq8HwYACgkQBWQfF1cS
+ltalwwAiNuu20iFY+qhJsIj5q4bmWH9JpmriySNkJvb6RLcRrcRaS9ne7V0RG0k
PMlQs4by4okdurjFh8V9tTg1ss4LP3BC/6nekV38ESCikQjY6XDgUdrJdyEWQCdh
GdlkS1bLqAw6lS1yLClShkbjiUopfLyB6tWUmSYmh3uFQdnhWpCD7zUBozIDxjuI
wHuy9bdhDka4LQR+Zl61Yv+rC8hbFLPnfTqix6HBlizFg9dceRCGqpVtscgeEBUt
bcptJf8MpW4+4hMUD0J2Hig363CdMrGjudZIOsIc+GpOX9nMwqIrDaCHjNGKwkdS
PUT3AT7z3VFP84VO4NNZ5Wbaq8+f6u14g5zz6W3rPIFJ7ND+PydHEE1KtHlLxYJd
+/o+GNRFRdddBeI/Senvgap5+exJiBdZenm3vy7W4veSOWS6lTTwIYmtr2erqPow
cMdxhgK7GY8aDGI28vgrl/g7tNsQVu5vFnKDXGrVGBcLBd0DTQUFmntoH+GRlaoq
62OMoTI5
=0gn8
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-openssl-devel/attachments/20260929/4ad6f210/attachment.sig>