openSUSE-SU-2026:21423-1: important: Security update for jline3

openSUSE security update: security update for jline3
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21423-1
Rating: important
References:

  * bsc#1269021
  * bsc#1270083



Cross-References:

  * CVE-2026-56740
  * CVE-2026-56741



CVSS scores:

  * CVE-2026-56740 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56741 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.

Description:

This update for jline3 fixes the following issues:

- CVE-2026-56740: unauthenticated remote memory exhaustion via unbounded Telnet `NEW-ENVIRON` variables (bsc#1269021).
- CVE-2026-56741: unauthenticated remote DoS via Unbounded Telnet NAWS Terminal Geometry (bsc#1270083).

Changes for jline3:

- Update to upstream version 3.30.15

 + fix: guard regex matching against catastrophic backtracking
   (ReDoS) (#2018, backport of #2012):
   * Adds SafeRegex utility with TimeoutCharSequence to enforce
     wall-clock deadlines during regex matching
   * Fixes 8 locations across terminal, reader, and builtins
     where user-controlled input could trigger catastrophic
     backtracking
   * Addresses GHSA-r2xf-8xr9-62gw, GHSA-2v9w-34q6-wpqx,
     GHSA-ph9c-7hw9-vhhw, GHSA-5q95-hrpc-m3w3
 + fix: backport security hardening (#1986, #1995):
   * Create persisted history file with owner-only permissions
   * Use exclusive create for extracted native library temp files
 + fix: warn on insecure permissions when history file created
   concurrently


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-1334=1

Package List:

- openSUSE Leap 16.0:

  jline3-3.30.15-160000.1.1
  jline3-builtins-3.30.15-160000.1.1
  jline3-console-3.30.15-160000.1.1
  jline3-console-ui-3.30.15-160000.1.1
  jline3-curses-3.30.15-160000.1.1
  jline3-jansi-3.30.15-160000.1.1
  jline3-jansi-core-3.30.15-160000.1.1
  jline3-javadoc-3.30.15-160000.1.1
  jline3-native-3.30.15-160000.1.1
  jline3-reader-3.30.15-160000.1.1
  jline3-remote-telnet-3.30.15-160000.1.1
  jline3-style-3.30.15-160000.1.1
  jline3-terminal-3.30.15-160000.1.1
  jline3-terminal-jansi-3.30.15-160000.1.1
  jline3-terminal-jna-3.30.15-160000.1.1
  jline3-terminal-jni-3.30.15-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2026-56740.html
  * https://www.suse.com/security/cve/CVE-2026-56741.html