Accepted apr-util 1.6.3-3+deb13u1 (source) into proposed-updates

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 09 Aug 2026 18:26:22 +0200
Source: apr-util
Architecture: source
Version: 1.6.3-3+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Apache Maintainers <[email protected]>
Changed-By: Bastien Roucariès <[email protected]>
Closes: 1143837
Changes:
 apr-util (1.6.3-3+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload on behalf of Apache Team.
     (Closes: #1143837)
   * Fix CVE-2025-49506:
     Function apr_password_validate() was not constant-time with
     regards to hashes or passwords comparisons, potentially leaking
     their content via a side channel timing attack.
   * Fix CVE-2026-32327:
     A stack recursion attack against any library consumer
     which parses XML from untrusted sources and uses the
     apr_xml_quote_elem() function
   * Fix CVE-2026-34191:
     Improper Neutralization of Special Elements used
     in an SQL Command (SQL Injection) vulnerability
     in Apache Portable Runtime Utility via apr_dbd_oracle provider.
   * Fix CVE-2026-34501:
     Heap-based Buffer Overflow vulnerability in Apache Portable
     Runtime Utility redis client.
   * Fix CVE-2026-34502:
     Heap-based Buffer Overflow vulnerability in Apache Portable
     Runtime Utility memcached client
Checksums-Sha1:
 f7e142cf8d4d3c02942e513807a2b2413026bfe6 2572 apr-util_1.6.3-3+deb13u1.dsc
 8c6293a787b69986ce43bc49c7c247d4ff5fc828 432692 apr-util_1.6.3.orig.tar.bz2
 bc1f492a7e1e2b1468c23285c1d86f62f0dcbf31 348040 apr-util_1.6.3-3+deb13u1.debian.tar.xz
 ac6ca17ec03273650e02ed4a0960db0c368a5c32 5888 apr-util_1.6.3-3+deb13u1_source.buildinfo
Checksums-Sha256:
 1b1bc45ea8927794f1901e75a5415fff11625815b34fc4c071df89710c61f6e0 2572 apr-util_1.6.3-3+deb13u1.dsc
 a41076e3710746326c3945042994ad9a4fcac0ce0277dd8fea076fec3c9772b5 432692 apr-util_1.6.3.orig.tar.bz2
 5bd2179a2cd4ac4351286a107431111b738b8f0d1c8fa65022bef34b72629278 348040 apr-util_1.6.3-3+deb13u1.debian.tar.xz
 4a676e49089e9c4d8768acdd945e962eb649f4b0d5a2f318c7d7e165ada8694f 5888 apr-util_1.6.3-3+deb13u1_source.buildinfo
Files:
 5a4d8090fe2552bf7c3f53d06cba1eeb 2572 libs optional apr-util_1.6.3-3+deb13u1.dsc
 b6e8c9b31d938fe5797ceb0d1ff2eb69 432692 libs optional apr-util_1.6.3.orig.tar.bz2
 6d9ca0ac73b3a8eb9d9fc9c47a061e20 348040 libs optional apr-util_1.6.3-3+deb13u1.debian.tar.xz
 99a0383372dd2ec153ee840df1387c65 5888 libs optional apr-util_1.6.3-3+deb13u1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmp8fzIACgkQADoaLapB
CF9Eow/+MEHRdf3GNoP5hcp1rwcgmljmx3CLcNr5Rvkc9u8DJalB7fdu0SDVW6M/
KoayYJ1u3tzn6Ro0OYfmDnhDjIp59FA//2dkSGhHuhRYfpFdjGU6C0rGUaYzN1gW
Xl4nQnLFVWzMfuAuZLZSK1FJ5xp4tq+OrCHbOEd7bVv8iOPv9lN2iZBwLk1gouJG
OEBQvxREVxcoKyv3/RT6K5dO8lJoXwWnH3bkzCG11tSt2dWSksiABkc0v9Tg2x1c
vbZZ8oqn3WiDmA1f8cXQTGTXvjx3DGiyICGvjJm3mxYcXEGLFHaT7AOrXfKctCRt
JpefhxoVHyUf1jHDm0IBnoS31aGUy101gVnfYON9LEJPHraQRey9F7e1tB+p/a/T
mm/CzEizgH2cJmVo8G1Q3UfZ/xvE/ZUt3hojTT0rgBwy7bRrd8QbYra7A1+vkIfJ
EwJB1jJqYx/Kc5xU2pc3FakCJqoPx8cU6pI9qmdRGQNCZK87DhP9PYqJT8RM36T+
6/RkP+jcjpZa05vwG93DFmXJJOu0UwaayGZOcKwZcJQizebbL6b8ALY+9NB9urmy
Ne6+Oelt5QP/Xdee+nB4yM7b68ItONqcisY00uIUx/gAO98+gpp8PldI1oJ97PAM
WHLFtirzxSPMMO1ZW7DsVOeWfG+wZZb1cJTvopzUmXlPcGSHVGU=
=Lyar
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCaoTS2gAKCRCb9qggYcy5
IcWBAP9owTzaBQJAXunYsOI7nfHntWcVnMANAJcQNlQcKL2zAgD/d+KpBtRXvM3L
k5Vv9F54B6gMgU6d/1DNG+U+V7F9nAI=
=EqDC
-----END PGP SIGNATURE-----