Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

SUSE: 2022:3706-1 Moderate: Google-Gson Security Risk Mitigation

suse
Calendar Grey October 24, 2022
Dist Suse Esm H88
SUSE Security Patch for google-gson tackling CVE-2022-25647 at moderate risk level. Explore further to maintain system protection.
An update that fixes one vulnerability, contains one feature is now available

Summary

This update for google-gson fixes the following issues: Fixed security issue: - CVE-2022-25647: Deserialization of Untrusted Data (bsc#1199064) Other non security fixes: - Build with Java >= 9 in order to produce a modular jar by compiling the module-info.java sources with all other classes built with release 8 and still compatible with Java 8 - Upgrade to version 2.8.9 (jsc#SLE-24261) * Make OSGi bundle's dependency on sun.misc optional. * Deprecate Gson.excluder() exposing internal Excluder class. * Prevent Java deserialization of internal classes. * Improve number strategy implementation. * Fix LongSerializationPolicy null handling being inconsistent with Gson. * Support arbitrary Number implementation for Object and Number deserialization. * Bump proguard-maven-plugin from 2.4.0 to 2.5.1.

References

#1199064 SLE-24261

Cross- CVE-2022-25647

CVSS scores:

CVE-2022-25647 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2022-25647 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

SUSE Linux Enterprise Module for SUSE Manager Server 4.1

SUSE Manager Server 4.1

https://www.suse.com/security/cve/CVE-2022-25647.html

https://bugzilla.suse.com/1199064

Announcement ID: SUSE-SU-2022:3706-1
Rating: moderate

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here