-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 02 Jul 2026 22:28:07 +0300
Source: protobuf
Architecture: source
Version: 3.21.12-11+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Adrian Bunk <bunk@debian.org>
Closes: 1082381 1108057 1126302 1134895
Changes:
protobuf (3.21.12-11+deb13u1) trixie; urgency=medium
.
* Non-maintainer upload.
* Fix CVE-2026-0994: JSON recursion depth bypass (closes: #1126302).
* Fix CVE-2026-6409: PHP Denial of Service (closes: #1134895).
.
[ Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> ]
* Complete fix of CVE-2024-7254 (closes: #1082381):
- add recursion checks and recursion limit,
- add tests.
.
[ Laszlo Boszormenyi (GCS) ]
* Fix CVE-2025-4565: data containing an arbitrary number of recursive
groups, recursive messages or a series of SGROUP tags can be corrupted
by exceeding the Python recursion limit (closes: #1108057).
Checksums-Sha1:
ab88f63d8d42af219a219db2b9d3f0d26a980769 3075 protobuf_3.21.12-11+deb13u1.dsc
7aec582dff3ab784ca7d2a2c99e59c64e8866fb5 5141502 protobuf_3.21.12.orig.tar.gz
d57d3335b1e1f0d5a9258c23ff0c860090bb040e 48312 protobuf_3.21.12-11+deb13u1.debian.tar.xz
Checksums-Sha256:
8f60b706ef31fa14c88d93314a5a3ae07b98fa0bc3bb4b58739598de6357779a 3075 protobuf_3.21.12-11+deb13u1.dsc
930c2c3b5ecc6c9c12615cf5ad93f1cd6e12d0aba862b572e076259970ac3a53 5141502 protobuf_3.21.12.orig.tar.gz
52c7c9377a2cb93649fb778baf4fe76d4489893ef04bad675acfa9b16e6313d5 48312 protobuf_3.21.12-11+deb13u1.debian.tar.xz
Files:
256beb94b7e5df55ac9048da6900d5f1 3075 devel optional protobuf_3.21.12-11+deb13u1.dsc
d38562490234d8080bdbe8eb7baf937a 5141502 devel optional protobuf_3.21.12.orig.tar.gz
964899f3010a9b2c14603ccbeed6f1c2 48312 devel optional protobuf_3.21.12-11+deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmpGwHkACgkQiNJCh6LY
mLEpWg/9FMk3yD2YLya4M+zEtReTCpODpV4Eo5zRvM70dH7mfxCrrKaaA0PtmPzW
D45PWYzOGjGOC9YGU8fPSqRu26Y+9V1hT8XhHUeIB8oOFc61Vzl5vTcBB4QMan9L
udDe//9T+j2ZXkljlhjF1UAlm0Aoj5+GjXAc2r/kqfHBiQGs+5vT6+Z0BnbdgwNY
xXCKY1VWCjNbCcC3awXnMIxBjqFuOzFKN8VOMhBXpFwlX53828pWFjtBLnT0HntC
wDOKfyDXYBx/ypErB5iW8vGySQ+sgDKGmePMOqDXtq0kpfxXJZY6dQCmOIvp0zVA
h8Is943KN8qDJItDIKtt1Ie6fH69jLAnLgye6SIDYgNzpKFWFJZMKKJEYOZzuQYd
azfwGGsfc8Y60GfcctgV/ZshDja7aAyIenfz4odmvqwgZL/z4F+p3yTm9+0kYwFD
H44ozWAHOmiGuOvECjbraeNb2FHvOVqqQRzZRDX27mJwzxKxhSCEPQMd1Y/jeuJg
u8qjRe0qniBJ0Gjnw1MV5KJaAp5wcXoSfF4nXjeZFcsx+ZsCaWWDg45mQhif9s50
nIQt3cqU0ToIYHplbRFEG+EDVynSwiOAt65qgVEDj0QeGpwku8GB0xTtnGmIGx7n
/xW72wAxK+kI7jx3Dr12xsxVD6clANecDsHmYSlGqkEqY/CqpkY=
=MlG1
-----END PGP SIGNATURE-----
Attachment:
pgpLDbvzVuJsv.pgp
Description: PGP signature