XPost: linux.debian.devel.release

--NmY21pW+BpU5p8gY
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Package: release.debian.org
Severity: normal
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:gnutls28
User: [email protected]
Usertags: unblock

Please unblock package gnutls28

The new version of gnutls cherry-picks couple of security fixes and
memory errors froim upstream's 3.8.10 release:

+ libgnutls: Fix NULL pointer dereference when 2nd Client Hello omits
PSK Reported by Stefan B�hler.
[GNUTLS-SA-2025-07-07-4, CVSS: medium] [CVE-2025-6395]
+ libgnutls: Fix heap read buffer overrun in parsing X.509 SCTS
timestamps Spotted by oss-fuzz and reported by OpenAI Security
Research Team, and fix developed by Andrew Hamilton.
[GNUTLS-SA-2025-07-07-1, CVSS: medium] [CVE-2025-32989]
+ libgnutls: Fix double-free upon error when exporting otherName in
SAN Reported by OpenAI Security Research Team.
[GNUTLS-SA-2025-07-07-2, CVSS: low] [CVE-2025-32988]
+ certtool: Fix 1-byte write buffer overrun when parsing template
Reported by David Aitel. [GNUTLS-SA-2025-07-07-3, CVSS: low]
[CVE-2025-32990]
+ Fixes for memory leaks in lib/x509/x509_ext.c andlib/hello_ext.c.
+ Fix uninitialized memory read while processing the "pre_shared_key"
extension in TLS 1.3.
+ Avoid uninitialized use of crq version.

Please ublock and bump urgency. Thanks!

unblock gnutls28/3.8.9-3

cu Andreas
--
`What a good friend you are to him, Dr. Maturin. His other friends are
so grateful to you.'
`I sew his ears on from time to time, sure'

--NmY21pW+BpU5p8gY
Content-Type: text/x-diff; charset=iso-8859-1
Content-Disposition: attachment; filename="from3.8.9-2.deb.diff" Content-Transfer-Encoding: quoted-printable

diff --git a/debian/changelog b/debian/changelog
index baec883..2362fb9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,28 @@
+gnutls28 (3.8.9-3) unstable; urgency=medium
+
+ * Cherry-pick fixes from 3.8.10 release:
+ + libgnutls: Fix NULL pointer dereference when 2nd Client Hello omits
+ PSK Reported by Stefan B�hler.
+ [GNUTLS-SA-2025-07-07-4, CVSS: medium] [CVE-2025-6395]
+ + libgnutls: Fix heap read buffer overrun in parsing X.509 SCTS
+ timestamps Spotted by oss-fuzz and reported by OpenAI Security
+ Research Team, and fix developed by Andrew Hamilton.
+ [GNUTLS-SA-2025-07-07-1, CVSS: medium] [CVE-2025-32989]
+ + libgnu