SUSE-SU-2026:5017-1: Security update for apache-commons-codec, apache-commons-io, apache-commons-logging, avalon-framework, avalon-logkit, glassfish-jsp, jsch, maven-file-management, opentest4j
This update for apache-commons-codec, apache-commons-io, apache-commons-logging, avalon-framework, avalon-logkit, glassfish-jsp, jsch, maven-file-management, opentest4j fixes the following issue:
- CVE-2026-86231: improper check for certificate revocation when processing knownhosts entries (bsc#1279889).
Changes for apache-commons-codec:
- Updated to version 1.22.0.
Changes for apache-commons-io:
- Updated to version 2.22.0.
Changes for apache-commons-logging:
- Updated to version 1.4.0.
Changes for jsch:
- Updated to version 2.28.7.
Changes for maven-file-management:
- Updated to version 3.2.0.
Changes for opentest4j:
- Updated to version 1.3.0.
Other sources
This update for apache-commons-codec, apache-commons-io, apache-commons-logging, avalon-framework, avalon-logkit, glassfish-jsp, jsch, maven-file-management, opentest4j fixes the following issue: CVE-2026-86231: improper check for certificate revocation when processing knownhosts entries (bsc#1279889). Changes for apache-commons-codec: Updated to version 1.22.0. Changes for apache-commons-io: Updated to version 2.22.0. Changes for apache-commons-logging: Updated to version 1.4.0. Changes for jsch: Updated to version 2.28.7. Changes for maven-file-management: Updated to version 3.2.0. Changes for opentest4j: Updated to version 1.3.0.
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/apache-commons-codecto a version that resolves this vulnerability.Fixed in 1.22.0-150200.3.12.1 - Upgrade
Upgrade
suse/apache-commons-ioto a version that resolves this vulnerability.Fixed in 2.22.0-150200.3.18.1 - Upgrade
Upgrade
suse/apache-commons-loggingto a version that resolves this vulnerability.Fixed in 1.4.0-150200.11.12.1 - Upgrade
Upgrade
suse/jschto a version that resolves this vulnerability.Fixed in 2.28.7-150200.11.19.1 - Upgrade
Upgrade
suse/maven-file-managementto a version that resolves this vulnerability.Fixed in 3.2.0-150200.3.10.1 - Upgrade
Upgrade
suse/opentest4jto a version that resolves this vulnerability.Fixed in 1.3.0-150200.3.9.1 - Upgrade
Upgrade
suse/glassfish-jspto a version that resolves this vulnerability.Fixed in 2.3.4-150200.3.7.1 - Upgrade
Upgrade
suse/avalon-frameworkto a version that resolves this vulnerability.Fixed in 4.3-150200.3.9.1 - Upgrade
Upgrade
suse/avalon-framework-apito a version that resolves this vulnerability.Fixed in 4.3-150200.3.9.1 - Upgrade
Upgrade
suse/avalon-logkitto a version that resolves this vulnerability.Fixed in 2.1-150200.11.9.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.22.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.3.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.22.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.28.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.2.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP7-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Development-Tools-15-SP7-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-5017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-5017
Event History
Frequently Asked Questions
Which component is associated with the certificate-revocation issue?
The issue is described as occurring when processing known_hosts entries, and JSch is among the components updated by this advisory. The provided data does not identify which of the other listed components, if any, are directly affected by this CVE.
What JSch version does this update provide?
The update changes JSch to version 2.28.7.
Which other component versions are updated by this advisory?
Apache Commons Codec is updated to 1.22.0, Apache Commons IO to 2.22.0, Apache Commons Logging to 1.4.0, Maven File Management to 3.2.0, and OpenTest4J to 1.3.0.