Source: qpid-proton Version: 0.37.0-6 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for qpid-proton. CVE-2026-105031[0]: | When using the OpenSSL TLS implementation, both the | pn_ssl_domain_set_trusted_ca_db() | & pn_tls_config_set_trusted_certs() APIs added to rather than | replaced the default system trust anchors. Leading to potentially | trusting unexpected peer certificates. This can be worked around | by setting the SSL_CERT_FILE environment variable for the | application to /dev/null. This issue does not affect the Win32 | SChannel TLS implementation. This issue affects Apache Qpid | Proton C: through 0.40.0. Users are recommended to upgrade to | version 0.41.1, which fixes the issue. CVE-2026-105042[1]: | A message body that is deeply nested and decoded by | pn_message_body() could overflow the stack and cause a crash. | This issue affects Apache Qpid Proton C: through 0.40.0. Users | are recommended to upgrade to version 0.41.1, which fixes the issue. CVE-2026-114230[2]: | When dispatching SASL frames to authenticate the peer, Proton will | also dispatch AMQP frames if they claim to be SASL frames. This | allows authentication bypass. However there will be no user name set | so the effects depend on how the application deals with this | condition - which otherwise means that authentication has not | completed yet. This issue affects Apache Qpid Proton C: through | 0.40.0. Users are recommended to upgrade to version 0.41.1, which | fixes the issue. CVE-2026-115942[3]: | A misconfigured wildcard TLS certificate causes a stack read | overflow. This issue does not affect any wildcard certificate | issued to the RFC9525 standard - the fix only accepts certificates | that comply to this standard. This issue affects Apache Qpid | Proton C: through 0.40.0. Users are recommended to upgrade to | version 0.41.1, which fixes the issue. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-105031 https://www.cve.org/CVERecord?id=CVE-2026-105031 [1] https://security-tracker.debian.org/tracker/CVE-2026-105042 https://www.cve.org/CVERecord?id=CVE-2026-105042 [2] https://security-tracker.debian.org/tracker/CVE-2026-114230 https://www.cve.org/CVERecord?id=CVE-2026-114230 [3] https://security-tracker.debian.org/tracker/CVE-2026-115942 https://www.cve.org/CVERecord?id=CVE-2026-115942 Regards, Salvatore
