Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package netty-tcnative for openSUSE:Factory checked in at 2026-11-03 17:59:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/netty-tcnative (Old) and /work/SRC/openSUSE:Factory/.netty-tcnative.new.1257 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "netty-tcnative" Tue Nov 3 17:59:05 2026 rev:14 rq:1394636 version:2.0.85 Changes: -------- --- /work/SRC/openSUSE:Factory/netty-tcnative/netty-tcnative.changes 2026-09-23 14:37:51.567588966 +0200 +++ /work/SRC/openSUSE:Factory/.netty-tcnative.new.1257/netty-tcnative.changes 2026-11-03 18:03:06.709352931 +0100 @@ -1,0 +2,38 @@ +Tue Nov 3 08:58:43 UTC 2026 - Fridrich Strba <[email protected]> + +- Upgrade to version 2.0.85 Final + * Fix out-of-bounds read in select_next_proto when no protocol + matches (#1044) + * Check for allocation failures that were previously unchecked + (#1040) + * Send unknown_ca when the chain was truncated and the + TrustManager rejected the certificate (#1038) + * Validate timeout, cache mode and cache size before narrowing + them (#1036) + * Don't sign-extend int options into the 64 bit SSL options + (#1035) + * Throw IllegalArgumentException when signing algorithm id does + not fit into 16 bits (#1034) + * Fix native memory leak in SSL_CTX_setup_certs when using + BoringSSL or AWS-LC (#1031) + * Do not discard the configured password when setCertificate(Bio) + fails without a new one (#1030) + * Throw NPE when null is passed to setSessionTicketKeys0 and + setSessionIdContext (#1028) + * Fix native memory leaks in SSLContext JNI_OnLoad (#1027) + * Fix native memory leaks in SSLContext.setPrivateKeyMethod0 + (#1026) + * Fix native memory leak in SSL.parseX509Chain when the BIO is + null (#1025) + * Support SSLContext.setKeyLogCallback with OpenSSL 1.1.1+ (#1021) + * Update getSigAlgs to handle algorithms without combined NID + (#1019) + * Delete local references to Java-returned result arrays in JNI + callbacks (#1016) + * Fix infinite loop in musl_compat fallbacks on old glibc headers + (#1037) + * Preserve musl compatibility in FIPS build (#1008) + * Update to latest netty-jni-util release (#1041) + * Upgrade apr to 1.7.6 (#1032) + +------------------------------------------------------------------- @@ -5 +43,13 @@ - * No formal changelog present + * Security fixes: + + CVE-2026-116539, GHSA-gf9q-9mg7-g5qh, bsc#1289170: Heap buffer + overflow in tcn_write_to_bytebuffer BIO callback from + unhandled ring buffer write index wrap (JVM crash DoS). + + CVE-2026-116540, GHSA-mmc8-vg2v-fvvw, bsc#1289171: + Use-after-free in ssl_tlsext_ticket_key_cb during session + ticket key rotation with OpenSSL 3.x. + + CVE-2026-116541, GHSA-9xr3-jwv4-r489, bsc#1289172: DoS in + tcn_write_to_bytebuffer BIO write callback overreporting + consumed bytes during TLS 1.3 post-handshake flights. + + CVE-2026-116542, GHSA-2784-hxmm-4hgf, bsc#1289173: SNI + hostname spoofing via embedded NUL bytes and overlong UTF-8 + encodings in JNI NewStringUTF decoding. Old: ---- netty-tcnative-parent-2.0.84.Final.tar.gz New: ---- netty-tcnative-parent-2.0.85.Final.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ netty-tcnative.spec ++++++ --- /var/tmp/diff_new_pack.v4AdSn/_old 2026-11-03 18:03:08.671435064 +0100 +++ /var/tmp/diff_new_pack.v4AdSn/_new 2026-11-03 18:03:08.674435190 +0100 @@ -17,13 +17,13 @@ %global namedreltag .Final -%global namedversion %{version}%{?namedreltag} %if 0%{?suse_version} < 1500 || 0%{?gcc_version} < 11 %define with_gcc 11 %endif Name: netty-tcnative -Version: 2.0.84 +Version: 2.0.85 Release: 0 +%global namedversion %{version}%{?namedreltag} Summary: Fork of Tomcat Native with improved OpenSSL and mavenized build License: Apache-2.0 Group: Development/Libraries/Java ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.v4AdSn/_old 2026-11-03 18:03:08.735437744 +0100 +++ /var/tmp/diff_new_pack.v4AdSn/_new 2026-11-03 18:03:08.740437953 +0100 @@ -1,6 +1,6 @@ -mtime: 1790090433 -commit: 12fa926183c8383abe17c5c965bbdd2950283b1ab7b743bc26bdd4a04151eb15 +mtime: 1793697748 +commit: 1ec9b23b108240afc9baddaa940e939cf269377ca3a46068ace08aaa3e313b68 url: https://src.opensuse.org/java-packages/netty-tcnative -revision: 12fa926183c8383abe17c5c965bbdd2950283b1ab7b743bc26bdd4a04151eb15 +revision: 1ec9b23b108240afc9baddaa940e939cf269377ca3a46068ace08aaa3e313b68 projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-11-03 10:22:28.000000000 +0100 @@ -0,0 +1 @@ +.osc ++++++ netty-tcnative-parent-2.0.84.Final.tar.gz -> netty-tcnative-parent-2.0.85.Final.tar.gz ++++++ ++++ 3204 lines of diff (skipped)
