-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 07 Nov 2026 09:16:13 -0600 Source: cjose Architecture: source Version: 0.6.2.1-1+deb12u2 Distribution: bookworm-security Urgency: high Maintainer: Moritz Schlarb <schlarbm@uni-mainz.de> Changed-By: Simon Quigley <tsimonq2@debian.org> Changes: cjose (0.6.2.1-1+deb12u2) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * CVE-2026-53938: heap buffer overflow in AES key unwrap. * CVE-2026-53939: all-zero content-encryption key for AES-CBC-HMAC. Checksums-Sha1: 77ae82b37eca7ee3e2801812377cad202ce8d7ba 2026 cjose_0.6.2.1-1+deb12u2.dsc d010e4f2221c124cbd81127f18aa43a4cfbd01c9 493790 cjose_0.6.2.1.orig.tar.gz 69a7dbad95cace98bcc7677aee93755e0daa84cf 8228 cjose_0.6.2.1-1+deb12u2.debian.tar.xz 83ac407bc435f54175ef46bafec9ad30c5d7b1a7 7031 cjose_0.6.2.1-1+deb12u2_source.buildinfo Checksums-Sha256: 752ec141c7a8287afa016085c1f2873b0d5e2434c3a439757c20ef37539ecebb 2026 cjose_0.6.2.1-1+deb12u2.dsc 90924f021878bfdb53536f8e3495876047d5b5ec34de96b431883c85f12c459a 493790 cjose_0.6.2.1.orig.tar.gz f925e8ff0549ff9c52a212336f0408a084637bdb2b4a98c0b7cf84b818480855 8228 cjose_0.6.2.1-1+deb12u2.debian.tar.xz cf4016837ce174379eddd2e6592e20bc98bcaf9864667ca63a594cafc1f00e46 7031 cjose_0.6.2.1-1+deb12u2_source.buildinfo Files: b217b5bc5fb24242bf22d3044bbd8d5a 2026 libs optional cjose_0.6.2.1-1+deb12u2.dsc c33c2583ed64f0c66da35d6aa3361936 493790 libs optional cjose_0.6.2.1.orig.tar.gz be9461f46bd6754617cae63a97cb349b 8228 libs optional cjose_0.6.2.1-1+deb12u2.debian.tar.xz cc0b346ad8830d42dd06624af385045d 7031 libs optional cjose_0.6.2.1-1+deb12u2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmrvQR4ACgkQ4n8s+EWM L6TBcw/9EFN61j5iHX5qviDfwnWMvURookSZSNvkqqAJvNBqHb8p/Rg61ZaOYuYc mAZS1fCqjKCzIryKMvF/y5KE/fHHIDgK+Sd+PfrUuuDOqdrFi7pTF0OiK2QZPjDN 3d6+CoOqjbqgSL72y6XP8GGU/pna91vhSpxMUtnIC/mvIyVe9izR6j/fwGq/SOfW 9HN/FVSIaOj6ksOV089B3crW50EvZacnEjl9mNh75sYubo/TPPJYLkFvbFwalZmF 3Al4536ZecVQWPRNcTMby2VfF7dQoCw2hnTGb86od4KBqS1CzPJcGhQaknvV+vl0 2vKK4h9RCcYDFEuCRn9hxhQVpbUxml+AB33fTLgWOwf1xZzzKte1/qCMStiff/PN MY2hqbceQrSCl10ccQpEAjFLR+Q8udVjoTvmXIE/WMBB1zZAqZt2dGebZMorqb6i kBm+uAsWV8A4rxlVDqweDbaB7J1W2gEHqc7cE7yKonvuyjJtEz+gHOaW3USo9gJg WoYBtXl6a49jRf5fPp7nGFuDErJKIAQ91tNP/5fHNV7Xu1Qy3eCMK5fD947lS4Gi 987/hlBmu6XtifjIMEeQP+1RBqAynvhQfIuuC7VPc+K50l9cBbn67ZwDy875sDdW kLhzA/l3zlhGVUuLqmFTyJT8aBUWxlqmBHYlDPa26RZTR9J2vMM= =pXvz -----END PGP SIGNATURE-----
