From: ftpmaster@ftp-master.debian.org 
  
 -----BEGIN PGP SIGNED MESSAGE----- 
 Hash: SHA512 
  
 Format: 1.8 
 Date: Tue, 02 Sep 2025 10:43:30 +0200 
 Source: python-eventlet 
 Architecture: source 
 Version: 0.39.1-2+deb13u1 
 Distribution: trixie 
 Urgency: medium 
 Maintainer: Debian OpenStack  
 Changed-By: Thomas Goirand  
 Closes: 1112515 
 Changes: 
  python-eventlet (0.39.1-2+deb13u1) trixie; urgency=medium 
  . 
    * CVE-2025-58068: Eventlet is a concurrent networking library for Python. 
      Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP 
      Request Smuggling due to improper handling of HTTP trailer sections. 
 This 
      vulnerability could enable attackers to, bypass front-end security 
      controls, launch targeted attacks against active site users, and poison 
 web 
      caches. Applied upstream patch (Closes: #1112515): 
      - Fix_request_smuggling_vulnerability_by_discarding_trailers.patch 
 Checksums-Sha1: 
  b9b6037b3c6671565c0ede94750024145c046bc1 2530 python-eventlet_0 
 39.1-2+deb13u1.dsc 
  d520366d95c0aaf40552363dc47c0f327f8bee1e 474744 python-eventlet 
 0.39.1.orig.tar.xz 
  73cf6a3035261b9e1e58d6a4312ddb5529e41a1e 24120 python-eventlet_ 
 .39.1-2+deb13u1.debian.tar.xz 
  863d29d0eae7fc46356f8d16b9310ac214daff24 9312 python-eventlet_0 
 39.1-2+deb13u1_amd64.buildinfo 
 Checksums-Sha256: 
  cc6a982b75c580856024ea0d26c5143a1a5913c6a27dfea51c54f8cd37db4160 2530 
 python-eventlet_0.39.1-2+deb13u1.dsc 
  0eb9e4b111d3c328900d53bc4fa39292850cf156a9c840c3ef198fb81d842600 474744 
 python-eventlet_0.39.1.orig.tar.xz 
  a70ab2c7ba043e01b34aff93b85601c806b42d7888c96e713629269837aac371 24120 
 python-eventlet_0.39.1-2+deb13u1.debian.tar.xz 
  b443b38bb3afdec07ad5525a2ec44462a975eca037c86e52e38e3b0e03ac69bb 9312 
 python-eventlet_0.39.1-2+deb13u1_amd64.buildinfo 
 Files: 
  ec622fb67b28ce750c2336a8d3aa93bb 2530 python optional python-ev 
 ntlet_0.39.1-2+deb13u1.dsc 
  5cfa1e5c920c8fe13df63d33b35a0dcb 474744 python optional python- 
 ventlet_0.39.1.orig.tar.xz 
  b8ede1dd0c831683da71614b6285ffaf 24120 python optional python-e 
 entlet_0.39.1-2+deb13u1.debian.tar.xz 
  480383549706e0952a3eb18b7d1b0863 9312 python optional python-ev 
 ntlet_0.39.1-2+deb13u1_amd64.buildinfo 
  
 -----BEGIN PGP SIGNATURE----- 
  
 iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmj2oM4ACgkQ1BatFaxr 
 Q/6+Qg//U9RGAt7DeC79LZ+zVkriebPyys3jH+DistKBJYG3zqQ1Z1cu5jvsl3SW 
 +jQO4jGFmTUftg47wPzqR1ogqtp5T67+rnTERJlUB0Ic5mig1J2z+zkfFL7uxuOt 
 v87Z+chiki7k9TGKJ7EcVVI67nx6dxh9btaonz4yshqJqOs3jK1ODWnY9a9hhIAZ 
 sneVkgBm/AOhP0MMOJp3lpzCRYqfpD79HrYoJukjnEHRbvhxrKDSXZOhscBxHjwa 
 pN/3dzJj8cFScYlAqphxhB3uzzNR0hQRax0Usb/bJWYtrWY8T4+7n1t2x6bqCBrr 
 s/lhtQxXGjO7mTzck9IuOTcvw+7Ctv5YwrjCIJmXxu4KkPFXeta6RkWzKhFzKTPF 
 pdbRNTLgKeNgHFrZhYd0yYdxWIhNzmUre35oiaYlPEt5FV4Kq5BH88gNvbWrkjaC 
 JyjnTMb0JuSOkXZQGbC/gMAEgUOZil8aRptKVJ5Q1qttnz0TeQrC0t2Sn+XFqaTi 
 qNoTUKM9MpEVi7/YkjOfu02JJcly2iP/omA0LW4Tt8thmhss/iA2fETFZ1IGqLWb 
 E6GbdGIM4vp81voJSv1szuVDZ6TEhVq7Jrptu1mxkvknRVwwzJVp9Rcjc2Ltjv9U 
 SHuQ2BGaNlB81EsE48UzBuSaFw+C9y4JPHAAgIyY6CsVhxuUxSE= 
 =oshl 
 -----END PGP SIGNATURE----- 
  
  
 --============== 42538544561528043=Content-Type: application/pgp-signature 
  
 -----BEGIN PGP SIGNATURE----- 
  
 iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCaPgUdQAKCRCb9qggYcy5 
 ISl9AQCzPywZB8y63+X5WlnE7CgzdCSM82KbIPThiSTitEwvTwD/R5hdgO5W4Ldy 
 lDvKMfIiq58vkO9L4bdvW23wUBhkJwY=brKk 
 -----END PGP SIGNATURE----- 
  
 --- SoupGate-Win32 v1.05 
  * Origin: you cannot sedate... all the things you hate (1:229/2)