SUSE-SU-2026:4658-1

Описание

This update for libtcnative-2-0 fixes the following issues:

• CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash (bsc#1282623).
• CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622).
• CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some configurations (bsc#1282621).

Changes for libtcnative-2-0:

• Upgrade to version 2.0.16

• Security fixes

• Client certificate requirements can be down-graded (bsc#1282621, CVE-2026-86247) A race condition allowed client certificate verification requirements to be down-graded for some configurations.
• Insecure OpenSSL options enabled (bsc#1282622, CVE-2026-86246) Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
• DoS via TLS handshake (bsc#1282623, CVE-2026-86243) A buffer over-read vulnerability in Apache Tomcat Native during the TLS handshaking permits a malicious user to trigger a DoS via a JVM crash.

• Changes

• Code: Remove call to ERR_remove_thread_state() from Windows specific code to allow building with OpenSSL 4.0.x ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got removed in OpenSSL 4
• Update: Remove support for Windows build on IA64 architecture (Itanium)
• Update: Make x64 the default architecture for Windows build
• Update: Make Windows 10 / 11 the default target version for Windows builds
• Fix: Fix a potential crash when negotiating ALPN
• Fix: If ALPN negotiation fails and failure is configured to use the last server protocol in the list, use it rather than the last protocol offered by the client
• Fix: Add support for the extended range of options available from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned int (represented by a Java long) rather than a 32-bit unsigned int (represented by a Java int)
• Code: Remove unused code
• Fix: Ensure that per connection changes to certificate verification settings, e.g. to support client certificate authentication, do not modify the certificate verification settings for other connections
• Fix: Fix a potential crash when configuring raw certificates
• Fix: Avoid a potential crash with very long ALPN protocol names
• Fix: Make the call to a CertificateVerifier more robust
• Fix: Avoid a potential crash when processing OCSP URLs
• Fix: Make the processing of OCSP responses more robust
• Fix: Stricter OCSP handling when soft-fail is disabled
• Fix: Harden against the mis-use of Buffer.address(ByteBuffer)
• Fix: Harden against the mis-use of Pool.destroy(long)