Hello, I filed bug #1153105 for this, but I'm told it didn't make it to this list. Please consider this the request. Pasted content of that bug below:
[ Reason ] Multiple vulnerabilities exist in all C-Kermit versions prior to 11.1.515, dating all the way back to 1984. My post at https://www.openwall.com/lists/oss-security/2026/11/02/1 summarizes them and contains links to the relevant advisories. These include remote code execution bugs. Due to the extensive hardening work that already took place in C-Kermit 11, backporting these bugs is infeasible. While I don't want to understate the severity of the bugs, which can be triggered by a malicious peer (or MITM peer), C-Kermit is most often used to communicate with legacy or embedded devices over serial ports. As such, the risk is limited for such cases. I raised this issue with [email protected], and security team member Salvatore Bonaccorso suggested the best path forward is to propose an update to trixie with you. Context: trixie carried the C-Kermit 10 beta series. Kermit co-founder and long-time maintainer Frank da Cruz, who had been involved with Kermit since 1981, retired from maintaining C-Kermit in 2025. As I had already been maintaining it here, I took up maintenance earlier this year, putting development under OpenKermit. I have been embarking on a long project to modernize and secure the codebase, and one of these efforts led to the discovery of the recent issues. [ Impact ] Users would be vulnerable to known RCE when connected to a malicious peer. [ Tests ] C-Kermit 11 introduced a massive new testsuite, which runs as part of the build process. [ Risks ] There are some changes in behavior that revolve around security or correctness. None of them are likely to pose a problem for the most common use of C-Kermit. Some, such as more modern default TLS/SSL suites, may cause an issue when talking to legacy equipment, but new settings are provided to restore them to the older defaults. A C-Kermit 10 compatibility mode is particularly designed for people that have such issues. All changes in behavior are carefully documented in /usr/share/doc/ckermit/changelog.gz. [ Checklist ] [X] *all* changes are documented in the d/changelog [X] I reviewed all changes and I approve them [X] attach debdiff against the package in (old)stable [X] the issue is verified as fixed in unstable [ Changes ] Covered above, and in doc/changelog.md in the source tree (/usr/share/doc/ckermit/changelog.gz on an installed system) [ Other info ] None [ckermit.debdiff.gz (application/gzip, attachment)] [debian.diff.gz (application/gzip, attachment)] Thanks, John
