[ Reason ]

Multiple vulnerabilities exist in all C-Kermit versions prior to 11.1.515,
dating all the way back to 1984.  My post at
https://www.openwall.com/lists/oss-security/2026/11/02/1 summarizes them and
contains links to the relevant advisories.  These include remote code execution
bugs.

Due to the extensive hardening work that already took place in C-Kermit 11,
backporting these bugs is infeasible.

While I don't want to understate the severity of the bugs, which can be
triggered by a malicious peer (or MITM peer), C-Kermit is most often used to
communicate with legacy or embedded devices over serial ports.  As such, the
risk is limited for such cases.

I raised this issue with security@debian.org, and security team member Salvatore
Bonaccorso suggested the best path forward is to propose an update to trixie
with you.

Context: trixie carried the C-Kermit 10 beta series.  Kermit co-founder and
long-time maintainer Frank da Cruz, who had been involved with Kermit since
1981, retired from maintaining C-Kermit in 2025.  As I had already been
maintaining it here, I took up maintenance earlier this year, putting
development under OpenKermit.  I have been embarking on a long project to
modernize and secure the codebase, and one of these efforts led to the discovery
of the recent issues.

[ Impact ]

Users would be vulnerable to known RCE when connected to a malicious peer.

[ Tests ]

C-Kermit 11 introduced a massive new testsuite, which runs as part of the build
process.

[ Risks ]

There are some changes in behavior that revolve around security or correctness.
None of them are likely to pose a problem for the most common use of C-Kermit.
Some, such as more modern default TLS/SSL suites, may cause an issue when
talking to legacy equipment, but new settings are provided to restore them to
the older defaults.  A C-Kermit 10 compatibility mode is particularly designed
for people that have such issues.  All changes in behavior are carefully
documented in /usr/share/doc/ckermit/changelog.gz.

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

[ Changes ]

Covered above, and in doc/changelog.md in the source tree
(/usr/share/doc/ckermit/changelog.gz on an installed system)

[ Other info ]

None