Bug 2543667

Summary:	CVE-2026-84782 bcvk: openssl: Information disclosure via DTLS handshake retransmission [epel-all]
Product:	[Fedora] Fedora EPEL	Reporter:	Marco Benatto <mbenatto>
Component:	bcvk	Assignee:	Gursewak Mangat <gurssing>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	epel10	CC:	gurssing
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["57c69a43-7943-4481-9b6e-c53b90f578b4"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-09-29 23:08:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2537080

Description Marco Benatto 2026-09-29 21:41:55 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through.
The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly.

Comment 1 Gursewak Mangat 2026-09-29 23:08:41 UTC

bcvk is not affected by this. bcvk links against the system OpenSSL library (via reqwest → native-tls → openssl-sys → system libssl), but only uses stream-based TLS for HTTPS connections (container image fetching and registry interactions). The DTLS code path affected by this CVE is not reachable through bcvk:

- No DTLS usage exists anywhere in the codebase
- The Rust native-tls crate does not expose OpenSSL's DTLS APIs
- No UDP/datagram sockets are created — a prerequisite for DTLS
- All network I/O is TCP-based HTTP/1.1 and HTTP/2 via the reqwest HTTP client

bcvk will pick up the fixed OpenSSL automatically when the system package is updated; no rebuild or code change is needed on bcvk's side.