-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 29 Sep 2026 21:40:01 +0200
Source: openssl
Architecture: source
Version: 4.0.3-1
Distribution: experimental
Urgency: medium
Maintainer: Debian OpenSSL Team <pkg-openssl-devel@alioth-lists.debian.net>
Changed-By: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Changes:
openssl (4.0.3-1) experimental; urgency=medium
.
* Import 4.0.3
- CVE-2026-84782 ("DTLS Retransmits Handshake Messages From a Stale Buffer
Offset")
- CVE-2026-35189 ("Memory Allocation in Relative CRLDP Processing")
- CVE-2026-35191 ("QUIC Unvalidated Amplification Credit may be Over
Accounted")
- CVE-2026-42772 ("Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC")
- CVE-2026-54872 ("Timing Side-Channel in Scalar Multiplication for Non-NIST
EC Curves")
- CVE-2026-54873 ("QUIC STREAM Fragment Metadata DoS")
- CVE-2026-54875 ("Non-Constant-Time SM2 Scalar Multiplication on ARM64 and
RISC-V")
- CVE-2026-72897 ("Out-of-Bounds Access After SSL_set_SSL_CTX() During a
Handshake")
- CVE-2026-75804 ("QUIC Connection-Level Flow Control is Not Enforced for
Streams")
- CVE-2026-75805 ("NULL Pointer Dereference in CMP Client Revocation
Response Handling")
- CVE-2026-75806 ("Unauthenticated and Undersized DTLS 1.2 AEAD Record
Causes DoS")
- CVE-2026-77696 ("Timing Side-Channel in SM2 Signature Generation")
- CVE-2026-84783 ("Use-After-Free in X.509 Extension Cache Under Concurrent Use")
- CVE-2026-84784 ("QUIC: Unbounded RETIRE_CONNECTION_ID Backlog")
Checksums-Sha1:
6cf5a7d272f40578ed8731d28e58d929eec375d9 2669 openssl_4.0.3-1.dsc
7035f60f356f8c80b76eebfdeb81a499f19028fa 55235667 openssl_4.0.3.orig.tar.gz
cab5d8309a5068cf98d47bf20916383fc1ed2949 931 openssl_4.0.3.orig.tar.gz.asc
0c3b0674b639e3f507c164dc942237f14fbe23ea 51540 openssl_4.0.3-1.debian.tar.xz
Checksums-Sha256:
922cc3b01ce3c7be21fe6e1ea5e178ff505c2adb68fee609eb90fa3166fefa31 2669 openssl_4.0.3-1.dsc
325b5c806167c13b40b1ffeadfe0248197c00eccc4cf123ec1e28d2d2fd216d9 55235667 openssl_4.0.3.orig.tar.gz
72c5a02be0ea5265093710f078c3eb30103d55ff2ce97004fb4f3b534a9fa3db 931 openssl_4.0.3.orig.tar.gz.asc
c8a8e690449fa7746d5fb7f906abd5432f6732de3ebc424f7a66de742bb49f21 51540 openssl_4.0.3-1.debian.tar.xz
Files:
0a65e77a709f3b423687aaedf47e828a 2669 utils optional openssl_4.0.3-1.dsc
dc334d00c9bfa2d165768a6f598e42a3 55235667 utils optional openssl_4.0.3.orig.tar.gz
da974cf8093673d9fad574017bd340c9 931 utils optional openssl_4.0.3.orig.tar.gz.asc
781e503dbe9ee37f9a7ce1b04a9dbbfd 51540 utils optional openssl_4.0.3-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQGzBAEBCgAdFiEEV4kucFIzBRM39v3RBWQfF1cS+lsFAmq8HwMACgkQBWQfF1cS
+lvlMQv6AgZUXvc62Ycz2LdCOVWioMnKct4JGaz1ERq43iZajB0t7kuIm5DppZwz
Dy0uo+sFD5CYwp1aW0w8eCrNMT+lw+2MwgU27TIlLD6TDQWYDPcZ01e/EjH4/w75
mssdAnVmi/CHbNNgmN2CPjJvpNNGEdNPT7rTRkihOzpkZD5MaimcYHFhkuBfsat4
4KfXPK9xpb3kNWGZjREIO80dtsZkz/vbf1AdZkUPs+LvfbGeAOvcHseteYA7t9N4
95rd8gXuE4S7xgxnMCM8CyDBSgeKhfTq9uV0vLNUnzHz7WNqnpMUOeWibg7+Y8Jp
DM++KOoRskeTy2Nzw8AwBtdopXEYonghbaCktYVpkvmyJnNjv5c5c+PxpRp9BU9c
hOue8l9K+XiXj21oH4yxsMtrrvYbtSyp1PNVgSfA/QxcL7T8Jn9369ymGuUUlviA
N4J04kXjP2fkQzru5+68EDjPfyll/W1eT5xqk3Mu9CNQJN0W2r01pqek9hHjJe+h
Adbm1hUz
=iMjo
-----END PGP SIGNATURE-----
