-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 12 Sep 2026 10:46:09 +0200 Source: cjose Binary: libcjose-dev libcjose0 libcjose0-dbgsym Architecture: armel Version: 0.6.2.3-1+deb13u1 Distribution: trixie-security Urgency: high Maintainer: armel Build Daemon (arm-ubc-04) Changed-By: Salvatore Bonaccorso Description: libcjose-dev - C library implementing the JOSE standard (development files) libcjose0 - C library implementing the JOSE standard Changes: cjose (0.6.2.3-1+deb13u1) trixie-security; urgency=high . * Non-maintainer upload by the Security Team. * fix heap buffer overflow in AES key unwrap (CVE-2026-53938) * jwe: fix all-zero CEK for AES-CBC-HMAC content encryption (CVE-2026-53939) Checksums-Sha1: 9401e322a9965dc078eb4dafe61b664c0bc088b4 6352 cjose_0.6.2.3-1+deb13u1_armel-buildd.buildinfo bbce6e5cc4b53060232d9aa1228e354d469e3003 43464 libcjose-dev_0.6.2.3-1+deb13u1_armel.deb d1a5c8fbfdaad19ac43bfce8e2fb7ae3d9e2681c 85904 libcjose0-dbgsym_0.6.2.3-1+deb13u1_armel.deb eb54033a380e7287a21fa3fd8f6cdfe9a6168685 33940 libcjose0_0.6.2.3-1+deb13u1_armel.deb Checksums-Sha256: 5c4118f96102d0cbd8f027d398b58d296034a37934a5cd48bbd9722b12b8b752 6352 cjose_0.6.2.3-1+deb13u1_armel-buildd.buildinfo 35d1ee584be44fe1ddebe48a2b3b4c3d7f8a369bdde6ba3904783ba2c2f83bae 43464 libcjose-dev_0.6.2.3-1+deb13u1_armel.deb 0b3d28e214eede79e143e5b948bc4bc768c1b558a415a6c86ac906fdff7e5707 85904 libcjose0-dbgsym_0.6.2.3-1+deb13u1_armel.deb 9fdf942f5ed579df19e718a64c12e3f5793716006b6256805f630c2fdb2b4212 33940 libcjose0_0.6.2.3-1+deb13u1_armel.deb Files: 37d2e8fad8ede0225e7b86e81795a849 6352 libs optional cjose_0.6.2.3-1+deb13u1_armel-buildd.buildinfo e2cc636cc57d556aabf45d5e268c1016 43464 libdevel optional libcjose-dev_0.6.2.3-1+deb13u1_armel.deb c16863d85be7cbeef74c7678adba82ba 85904 debug optional libcjose0-dbgsym_0.6.2.3-1+deb13u1_armel.deb 95dcee1c76afcce039662564b72177ad 33940 libs optional libcjose0_0.6.2.3-1+deb13u1_armel.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEECx5fXZYVNP9tMtwlK1PZBedPspoFAmqlHYoACgkQK1PZBedP spr78g/7Bgme5MPmQ8/OiKZURAfKf1SLmOSdUN8u2I8qKAbHg+GvRfRhYCbto/uy ECO3p9uN4GxiPPjiu1CjQJWHZ9A70LoUB1lHE+El0y2KwwonCokwvg2PCsoRW6hM BbsfS2UVb25SjJz0N0wGgMxe5LIHP4UKTdOZM+VkUSYolawiRvhlh+Zl4MWX/nL5 n0gp+ferASOgG6PW5cURFOcpL3hmoyPU1M0EM/1JHn2uN5MlQ9NxUryvpdAoFlAt FBXTaK5XVDnpBtamRkTVaPPVn/oeUreACONr7XPIFlifrO/3EXm7d4jTCTmhEQX9 ko+6iERHX+1QpODv8yqz3gvMBMz1Gs+zEahBZqT9bJq6hRWDIKgpbuQtM2Yp+X8H jdVgP0f2rXsvHMiDtdnbH3n1Gm+s8hovImwC1tK2jDk3uLSqHIqoZ2sJ3PcY72xF TB1uwvty5tabW9wiSIQWdT2M4FP5aFFyYyBQDcRn/Anwny6ckmcASmK75yMxBfM7 V8MJZQA3Zmfg6ZPw20Qr1s3gpFb6DlAqHJvWdNgnzl//Kv1j/upuJlfC9rfuiB3m rBbULcmQhTTaNbTrx4F2dKH3//H921TpNRBCZs9jxyNLArrYl8gt1Hdnv9DRO/4e mXwG9IgSEro68/WgtAf+E/mr2NYBEYG44xAaZ7Sl+tifyXkTvXQ= =TwVp -----END PGP SIGNATURE-----