openSUSE mbedtls-2 Moderate TLS Update Security Advisory 2026-21145-1

This update for mbedtls-2 fixes the following issues:

Changes in mbedtls-2:

- Enable SRTP and DTLS protocols needed by some software.

- Update to version 2.28.10:

Default behavior changes

* In TLS clients, if mbedtls_ssl_set_hostname() has not been called,

mbedtls_ssl_handshake() now fails with

MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME

if certificate-based authentication of the server is attempted.

This is because authenticating a server without knowing what name

to expect is usually insecure. To restore the old behavior, either

call mbedtls_ssl_set_hostname() with NULL as the hostname, or

enable the new compile-time option

MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME.

The content of ssl->hostname after mbedtls_ssl_set_hostname(ssl, NULL)

has changed, see the documentation of the hostname field in the

mbedtls_ssl_context struct type for details.

Security

* Note that TLS clients should...