11209 matches found
ECHO-3331-34A8-58FF
Bulletin has no description...
ECHO-DAEB-C7A3-60A5
Bulletin has no description...
ECHO-8388-6CB2-F86F D-only: a truncated HTTP request stops the D server. No D compiler is in Build-Depends, so lib/d is never built, and no binary package ships it.
Bulletin has no description...
ECHO-076B-BCC6-468F
Bulletin has no description...
ECHO-85D6-67D1-EFB4
Bulletin has no description...
ECHO-EEB1-DF32-DBAA The vulnerable code postdates this version. The Python >= 3.12 no-op host-name matcher (sslcompat returning True when ssl.match_hostname is missing) was introduced by 23e0e5ce (first released in 0.22.0) and is not an ancestor of v0.19.0. On trixie's Python 3.13 this version's sslcompat falls back to legacy_validate_callback, which compares the certificate commonName and raises on a mismatch; TSSLSocket uses PROTOCOL_SSLv23 (the PROTOCOL_TLS alias) with check_hostname off, so that callback is the check that runs. Verified with real handshakes against the built lib on Python 3.13.5: a certificate for "localhost" offered to a client expecting "wrong.example" is refused with the default ssl_version, with an explicit PROTOCOL_TLS (the upstream regression case) and with PROTOCOL_TLSv1_2, and TSSLServerSocket refuses a trusted client certificate issued for another identity. The same script against upstream v0.24.0's lib accepts both explicit-ssl_version mismatches, as the CVE describes. The fix d6782a87 restores a real matcher in sslcompat (code this version never lost) and turns on check_hostname for explicit-ssl_version contexts, which 0.19.0 does not need because open() always runs _validate_callback. Same reasoning as CVE-2026-66053.
Bulletin has no description...
ECHO-2142-C2ED-FA0B
Bulletin has no description...
ECHO-8349-28F8-24B1 Delphi-only: buffered transport reads are not counted against MaxMessageSize. lib/delphi has no autotools build and no binary package ships it.
Bulletin has no description...
ECHO-6408-669E-310F
Bulletin has no description...
ECHO-8D5E-E094-CE34 Lua-only: the TJsonProtocol string and number readers are unbounded and quadratic. Built with --without-lua; no Lua binary package is produced.
Bulletin has no description...
ECHO-5526-4FCA-655E
Bulletin has no description...
ECHO-6CE9-8269-79FE
Bulletin has no description...
ECHO-9DE0-0234-BF47
Bulletin has no description...
ECHO-2692-DD04-73D6
Bulletin has no description...
ECHO-0AB6-1F5D-9AD5
Bulletin has no description...
ECHO-C0B6-CB12-097D
Bulletin has no description...
ECHO-E8F1-BAA7-9BB5
Bulletin has no description...
ECHO-4756-8481-EA87
Bulletin has no description...
ECHO-30F3-2738-F894
Bulletin has no description...
ECHO-306B-24C3-45BD
Bulletin has no description...
ECHO-9EAB-0368-CED7
Bulletin has no description...
ECHO-CF9B-87CA-645C
Bulletin has no description...
ECHO-89D0-4DE4-3380
Bulletin has no description...
ECHO-023C-6B50-66B5
Bulletin has no description...
ECHO-8846-7FBC-2389
Bulletin has no description...
ECHO-62CC-9713-AAF7
Bulletin has no description...
ECHO-54BB-3D76-70E2
Bulletin has no description...
ECHO-334D-48A7-6E03
Bulletin has no description...
ECHO-E013-9D17-E16A
Bulletin has no description...
ECHO-E305-29D2-DCB3
Bulletin has no description...
ECHO-874B-AD07-3E0F
Bulletin has no description...
ECHO-6EAE-343C-BDBC
Bulletin has no description...
ECHO-247E-4779-126F
Bulletin has no description...
ECHO-2AF1-2F46-154F
Bulletin has no description...
ECHO-ACA5-37C5-5309
Bulletin has no description...
ECHO-6C5E-2E46-3D72
Bulletin has no description...
ECHO-8BAA-DAFF-36FE
Bulletin has no description...
ECHO-6FA8-503E-6F0C
Bulletin has no description...
ECHO-8ED6-1D57-BBBB
Bulletin has no description...
ECHO-5430-843D-4E83
Bulletin has no description...
ECHO-E525-7FD8-E0A9
Bulletin has no description...
ECHO-7422-CD67-7869
Bulletin has no description...
ECHO-019F-63C0-337D
Bulletin has no description...
ECHO-10C7-2461-3C34
Bulletin has no description...
ECHO-F4B6-1EA9-1BE2
Bulletin has no description...
ECHO-3371-0819-2138
Bulletin has no description...
ECHO-EC3D-5C92-15D6
Bulletin has no description...
ECHO-678C-C9A6-F2DC
Bulletin has no description...