Security update for google-gson
| Announcement ID: | SUSE-SU-2022:3706-1 |
|---|---|
| Rating: | moderate |
| References: | |
| Cross-References: | |
| CVSS scores: |
|
| Affected Products: |
|
An update that solves one vulnerability and contains one feature can now be installed.
Description:
This update for google-gson fixes the following issues:
Fixed security issue:
- CVE-2022-25647: Deserialization of Untrusted Data (bsc#1199064)
Other non security fixes:
- Build with Java >= 9 in order to produce a modular jar by compiling the module-info.java sources with all other classes built with release 8 and still compatible with Java 8
- Upgrade to version 2.8.9 (jsc#SLE-24261)
- Make OSGi bundle's dependency on sun.misc optional.
- Deprecate Gson.excluder() exposing internal Excluder class.
- Prevent Java deserialization of internal classes.
- Improve number strategy implementation.
- Fix LongSerializationPolicy null handling being inconsistent with Gson.
- Support arbitrary Number implementation for Object and Number deserialization.
- Bump proguard-maven-plugin from 2.4.0 to 2.5.1.
- Don't exclude static local classes.
- Fix RuntimeTypeAdapterFactory depending on internal Streams class.
- Improve Maven build.
- Make dependency on java.sql optional.
- Fixed issue with recursive types.
- Better behavior with Java 9+ and Unsafe if there is a security manager.
- EnumTypeAdapter now works better when ProGuard has obfuscated enum fields.
- make import of sun.misc optional since not all versions of jdk export it
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Manager Server 4.1 Module 4.1
zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.1-2022-3706=1
Package List:
-
SUSE Manager Server 4.1 Module 4.1 (noarch)
- google-gson-2.8.9-150200.3.7.1