-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 12 Sep 2026 10:46:09 +0200 Source: cjose Architecture: source Version: 0.6.2.3-1+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Moritz Schlarb <schlarbm@uni-mainz.de> Changed-By: Salvatore Bonaccorso <carnil@debian.org> Changes: cjose (0.6.2.3-1+deb13u1) trixie-security; urgency=high . * Non-maintainer upload by the Security Team. * fix heap buffer overflow in AES key unwrap (CVE-2026-53938) * jwe: fix all-zero CEK for AES-CBC-HMAC content encryption (CVE-2026-53939) Checksums-Sha1: ab783a5c1b8726d140ded9b3f2632ba278e3df3b 2179 cjose_0.6.2.3-1+deb13u1.dsc 0519b41ed388c94b1d926c53624e6ec62a98fcd2 500613 cjose_0.6.2.3.orig.tar.gz 9616f38974c73760bc13912f910582c763b10cb3 7644 cjose_0.6.2.3-1+deb13u1.debian.tar.xz 0f53a4c078e2b5f4a0fbee1e7b8bda1f45f754cc 6270 cjose_0.6.2.3-1+deb13u1_source.buildinfo Checksums-Sha256: aa42cef1bf1d68c0b14c7df0bfe922495e0f43aeb31e8283ce5a7fc0dd806348 2179 cjose_0.6.2.3-1+deb13u1.dsc 604f9022e8c656a8cccf3872f22a1969859ecd4cd10b4f61d9979c174824958b 500613 cjose_0.6.2.3.orig.tar.gz 33257d91dc7e9007e5c000a988e8b8fd55b0ca5dd75f0211de510fe456157677 7644 cjose_0.6.2.3-1+deb13u1.debian.tar.xz 68e33c642cb9afd66fd24efe016999a067297d21e9931228c9a26d3eb8ebd380 6270 cjose_0.6.2.3-1+deb13u1_source.buildinfo Files: 120e45ea9efc7ef899213a8c2da1bfdc 2179 libs optional cjose_0.6.2.3-1+deb13u1.dsc 2c124bd103f76c501b0dbdde72163701 500613 libs optional cjose_0.6.2.3.orig.tar.gz e3099441e3ea2e0d9328783b4b4fb7d0 7644 libs optional cjose_0.6.2.3-1+deb13u1.debian.tar.xz 5431b08ae238d3baec69efa43fd6dbcc 6270 libs optional cjose_0.6.2.3-1+deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmqlFJJfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89EoqsP+gJW8hpQAN8+ueq2/vky+NwqjmjRTUIc VjjEGQ8UW9IgxHIrU+gzGZ+OQCButwUzD9T7TWlJQqF8rFlEtkGY9GT7OeOLl/FG +M4BDm02BaeCZDtv3nL9T6PgYs3ObTW1tTen3MRu7RVkXMYIfLSMJu8y2dUbnKPt 7M4RilEYKzr+JPYS7S3Wqa9n7cSgwRqxeheUAGeyBkVvGF0c1iQrFa7entBzL11j HWNMXgIsWmOHTMgxit6ldv9mwD0DcD4taxtikzzojrqxxR96jtOYccElfxl3kU0U DOpH8O/1eyUBPYtSmbYzXpVlwWVHaw4PgqNE/NnFKi6OtVf3OuFEQ3xVX/RtCaR1 bRF6mpwfr+OYDqQe8DOSQle0SeEWXjZDjaTIQnm+fnGYAvo7wd+y4xV4TRJAyHmj z0q0UnP0PZKPoeqn0bG/C3hHqrcfHa32KNCINZ2isYZHIUpam8cjsBoUedCTgnmp JXyZJLk0//w1HWtESSc5lpDkuv9SvZufHBCMi/QF8gasXDtaMDEzQKEt82gj355e eMq0oMPkpNTmrwly5Cw45yE5I5n7v1BgD4H17FGyjPv8283tsp+UEti1N5v9zRji me3OGzzM9X4ztgvPOg/wXWKprQPRQwTBC1bIFibphWjhepQx2+TcV3Fj9InVINs7 SkfpR8677f+e =2pAN -----END PGP SIGNATURE-----
