-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 29 Sep 2026 21:39:32 +0200
Source: openssl
Architecture: source
Version: 3.6.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenSSL Team <pkg-openssl-devel@alioth-lists.debian.net>
Changed-By: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Changes:
openssl (3.6.5-1) unstable; urgency=medium
.
* Import 3.6.5
- CVE-2026-84782 ("DTLS Retransmits Handshake Messages From a Stale Buffer
Offset")
- CVE-2026-35189 ("Memory Allocation in Relative CRLDP Processing")
- CVE-2026-35191 ("QUIC Unvalidated Amplification Credit may be Over
Accounted")
- CVE-2026-42772 ("Potential CPU DoS via O(n^2) Fragment Reassembly in
QUIC")
- CVE-2026-54872 ("Timing Side-Channel in Scalar Multiplication for Non-NIST
EC Curves")
- CVE-2026-54873 ("QUIC STREAM Fragment Metadata DoS")
- CVE-2026-54875 ("Non-Constant-Time SM2 Scalar Multiplication on ARM64 and
RISC-V")
- CVE-2026-72897 ("Out-of-Bounds Access After SSL_set_SSL_CTX() During a
Handshake")
- CVE-2026-75804 ("QUIC Connection-Level Flow Control is Not Enforced for
Streams")
- CVE-2026-75805 ("NULL Pointer Dereference in CMP Client Revocation
Response Handling")
- CVE-2026-75806 ("Unauthenticated and Undersized DTLS 1.2 AEAD Record
Causes DoS")
- CVE-2026-77696 ("Timing Side-Channel in SM2 Signature Generation")
- CVE-2026-84784 ("QUIC: Unbounded RETIRE_CONNECTION_ID Backlog")
Checksums-Sha1:
515d9acae56aa36d6f0f82154d7c014452b1f5ee 2675 openssl_3.6.5-1.dsc
89256e2bf2e5c761c9b4c49925d816f0e3b25fe4 55078161 openssl_3.6.5.orig.tar.gz
786526396deda6be892ee0ec1d65d172f872b0fc 931 openssl_3.6.5.orig.tar.gz.asc
9cc7314ed0802cf11deb74b302567010963eb5b2 52240 openssl_3.6.5-1.debian.tar.xz
Checksums-Sha256:
94f49bd74c6dd95facafca0ccb36aaf738c19cb3cd13c4073838b9b26141ed97 2675 openssl_3.6.5-1.dsc
a2157c2830efdec3788939b00c9b0638306d3f0bbb76dc4832ee503bb397df98 55078161 openssl_3.6.5.orig.tar.gz
85b3e373c1e1f94f6f043a4774377d04e752549c33c0f84b9f417a78b90c2372 931 openssl_3.6.5.orig.tar.gz.asc
d0c62de0e6ad123327a40af6f7f214abf409b13e291ffe5e1dcc9a83f25e4e22 52240 openssl_3.6.5-1.debian.tar.xz
Files:
98610ec9fe44a1b2cd5ecadb2d8aea3d 2675 utils optional openssl_3.6.5-1.dsc
e1df3c3fea55e3dc8bcb6b422f436fbc 55078161 utils optional openssl_3.6.5.orig.tar.gz
2a22d0411def29510b37aca34e866e9b 931 utils optional openssl_3.6.5.orig.tar.gz.asc
11a100b7502c9f4f5a333173ff1052bd 52240 utils optional openssl_3.6.5-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQGzBAEBCgAdFiEEV4kucFIzBRM39v3RBWQfF1cS+lsFAmq8HwYACgkQBWQfF1cS
+ltalwwAiNuu20iFY+qhJsIj5q4bmWH9JpmriySNkJvb6RLcRrcRaS9ne7V0RG0k
PMlQs4by4okdurjFh8V9tTg1ss4LP3BC/6nekV38ESCikQjY6XDgUdrJdyEWQCdh
GdlkS1bLqAw6lS1yLClShkbjiUopfLyB6tWUmSYmh3uFQdnhWpCD7zUBozIDxjuI
wHuy9bdhDka4LQR+Zl61Yv+rC8hbFLPnfTqix6HBlizFg9dceRCGqpVtscgeEBUt
bcptJf8MpW4+4hMUD0J2Hig363CdMrGjudZIOsIc+GpOX9nMwqIrDaCHjNGKwkdS
PUT3AT7z3VFP84VO4NNZ5Wbaq8+f6u14g5zz6W3rPIFJ7ND+PydHEE1KtHlLxYJd
+/o+GNRFRdddBeI/Senvgap5+exJiBdZenm3vy7W4veSOWS6lTTwIYmtr2erqPow
cMdxhgK7GY8aDGI28vgrl/g7tNsQVu5vFnKDXGrVGBcLBd0DTQUFmntoH+GRlaoq
62OMoTI5
=0gn8
-----END PGP SIGNATURE-----
