SUSE: 2022:3706-1 moderate: google-gson | LinuxSecurity.com

   SUSE Security Update: Security update for google-gson
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:3706-1
Rating:             moderate
References:         #1199064 SLE-24261 
Cross-References:   CVE-2022-25647
CVSS scores:
                    CVE-2022-25647 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-25647 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:
                    SUSE Linux Enterprise Module for SUSE Manager Server 4.1
                    SUSE Manager Server 4.1
______________________________________________________________________________

   An update that fixes one vulnerability, contains one
   feature is now available.

Description:

   This update for google-gson fixes the following issues:

   Fixed security issue:

   - CVE-2022-25647: Deserialization of Untrusted Data (bsc#1199064)

   Other non security fixes:

   - Build with Java >= 9 in order to produce a modular jar by compiling the
     module-info.java sources with all other classes built with release 8 and
     still compatible with Java 8
   - Upgrade to version 2.8.9 (jsc#SLE-24261)
     * Make OSGi bundle's dependency on sun.misc optional.
     * Deprecate Gson.excluder() exposing internal Excluder class.
     * Prevent Java deserialization of internal classes.
     * Improve number strategy implementation.
     * Fix LongSerializationPolicy null handling being inconsistent with Gson.
     * Support arbitrary Number implementation for Object and Number
       deserialization.
     * Bump proguard-maven-plugin from 2.4.0 to 2.5.1.
     * Don't exclude static local classes.
     * Fix RuntimeTypeAdapterFactory depending on internal Streams class.
     * Improve Maven build.
     * Make dependency on java.sql optional.
     * Fixed issue with recursive types.
     * Better behavior with Java 9+ and Unsafe if there is a security manager.
     * EnumTypeAdapter now works better when ProGuard has obfuscated enum
       fields.
     *  make import of sun.misc optional since not all versions of jdk export
        it


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for SUSE Manager Server 4.1:

      zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.1-2022-3706=1



Package List:

   - SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (noarch):

      google-gson-2.8.9-150200.3.7.1


References:

   https://www.suse.com/security/cve/CVE-2022-25647.html
   https://bugzilla.suse.com/1199064

SUSE: 2022:3706-1 moderate: google-gson

October 24, 2022
An update that fixes one vulnerability, contains one feature is now available

Summary

This update for google-gson fixes the following issues: Fixed security issue: - CVE-2022-25647: Deserialization of Untrusted Data (bsc#1199064) Other non security fixes: - Build with Java >= 9 in order to produce a modular jar by compiling the module-info.java sources with all other classes built with release 8 and still compatible with Java 8 - Upgrade to version 2.8.9 (jsc#SLE-24261) * Make OSGi bundle's dependency on sun.misc optional. * Deprecate Gson.excluder() exposing internal Excluder class. * Prevent Java deserialization of internal classes. * Improve number strategy implementation. * Fix LongSerializationPolicy null handling being inconsistent with Gson. * Support arbitrary Number implementation for Object and Number deserialization. * Bump proguard-maven-plugin from 2.4.0 to 2.5.1. * Don't exclude static local classes. * Fix RuntimeTypeAdapterFactory depending on internal Streams class. * Improve Maven build. * Make dependency on java.sql optional. * Fixed issue with recursive types. * Better behavior with Java 9+ and Unsafe if there is a security manager. * EnumTypeAdapter now works better when ProGuard has obfuscated enum fields. * make import of sun.misc optional since not all versions of jdk export it Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.1-2022-3706=1 Package List: - SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (noarch): google-gson-2.8.9-150200.3.7.1

References

#1199064 SLE-24261

Cross- CVE-2022-25647

CVSS scores:

CVE-2022-25647 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2022-25647 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

SUSE Linux Enterprise Module for SUSE Manager Server 4.1

SUSE Manager Server 4.1

https://www.suse.com/security/cve/CVE-2022-25647.html

https://bugzilla.suse.com/1199064

Severity
Announcement ID: SUSE-SU-2022:3706-1
Rating: moderate

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.