-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 29 Sep 2026 21:40:01 +0200 Source: openssl Architecture: source Version: 4.0.3-1 Distribution: experimental Urgency: medium Maintainer: Debian OpenSSL Team <[email protected]> Changed-By: Sebastian Andrzej Siewior <[email protected]> Changes: openssl (4.0.3-1) experimental; urgency=medium . * Import 4.0.3 - CVE-2026-84782 ("DTLS Retransmits Handshake Messages From a Stale Buffer Offset") - CVE-2026-35189 ("Memory Allocation in Relative CRLDP Processing") - CVE-2026-35191 ("QUIC Unvalidated Amplification Credit may be Over Accounted") - CVE-2026-42772 ("Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC") - CVE-2026-54872 ("Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves") - CVE-2026-54873 ("QUIC STREAM Fragment Metadata DoS") - CVE-2026-54875 ("Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V") - CVE-2026-72897 ("Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake") - CVE-2026-75804 ("QUIC Connection-Level Flow Control is Not Enforced for Streams") - CVE-2026-75805 ("NULL Pointer Dereference in CMP Client Revocation Response Handling") - CVE-2026-75806 ("Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS") - CVE-2026-77696 ("Timing Side-Channel in SM2 Signature Generation") - CVE-2026-84783 ("Use-After-Free in X.509 Extension Cache Under Concurrent Use") - CVE-2026-84784 ("QUIC: Unbounded RETIRE_CONNECTION_ID Backlog") Checksums-Sha1: 6cf5a7d272f40578ed8731d28e58d929eec375d9 2669 openssl_4.0.3-1.dsc 7035f60f356f8c80b76eebfdeb81a499f19028fa 55235667 openssl_4.0.3.orig.tar.gz cab5d8309a5068cf98d47bf20916383fc1ed2949 931 openssl_4.0.3.orig.tar.gz.asc 0c3b0674b639e3f507c164dc942237f14fbe23ea 51540 openssl_4.0.3-1.debian.tar.xz Checksums-Sha256: 922cc3b01ce3c7be21fe6e1ea5e178ff505c2adb68fee609eb90fa3166fefa31 2669 openssl_4.0.3-1.dsc 325b5c806167c13b40b1ffeadfe0248197c00eccc4cf123ec1e28d2d2fd216d9 55235667 openssl_4.0.3.orig.tar.gz 72c5a02be0ea5265093710f078c3eb30103d55ff2ce97004fb4f3b534a9fa3db 931 openssl_4.0.3.orig.tar.gz.asc c8a8e690449fa7746d5fb7f906abd5432f6732de3ebc424f7a66de742bb49f21 51540 openssl_4.0.3-1.debian.tar.xz Files: 0a65e77a709f3b423687aaedf47e828a 2669 utils optional openssl_4.0.3-1.dsc dc334d00c9bfa2d165768a6f598e42a3 55235667 utils optional openssl_4.0.3.orig.tar.gz da974cf8093673d9fad574017bd340c9 931 utils optional openssl_4.0.3.orig.tar.gz.asc 781e503dbe9ee37f9a7ce1b04a9dbbfd 51540 utils optional openssl_4.0.3-1.debian.tar.xz
-----BEGIN PGP SIGNATURE----- iQGzBAEBCgAdFiEEV4kucFIzBRM39v3RBWQfF1cS+lsFAmq8HwMACgkQBWQfF1cS +lvlMQv6AgZUXvc62Ycz2LdCOVWioMnKct4JGaz1ERq43iZajB0t7kuIm5DppZwz Dy0uo+sFD5CYwp1aW0w8eCrNMT+lw+2MwgU27TIlLD6TDQWYDPcZ01e/EjH4/w75 mssdAnVmi/CHbNNgmN2CPjJvpNNGEdNPT7rTRkihOzpkZD5MaimcYHFhkuBfsat4 4KfXPK9xpb3kNWGZjREIO80dtsZkz/vbf1AdZkUPs+LvfbGeAOvcHseteYA7t9N4 95rd8gXuE4S7xgxnMCM8CyDBSgeKhfTq9uV0vLNUnzHz7WNqnpMUOeWibg7+Y8Jp DM++KOoRskeTy2Nzw8AwBtdopXEYonghbaCktYVpkvmyJnNjv5c5c+PxpRp9BU9c hOue8l9K+XiXj21oH4yxsMtrrvYbtSyp1PNVgSfA/QxcL7T8Jn9369ymGuUUlviA N4J04kXjP2fkQzru5+68EDjPfyll/W1eT5xqk3Mu9CNQJN0W2r01pqek9hHjJe+h Adbm1hUz =iMjo -----END PGP SIGNATURE-----
pgp9OfXxLDIzM.pgp
Description: PGP signature
