Security update for google-gson SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3706-1 Final 1 1 2022-10-24T13:19:55Z current 2022-10-24T13:19:55Z 2022-10-24T13:19:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for google-gson This update for google-gson fixes the following issues: Fixed security issue: - CVE-2022-25647: Deserialization of Untrusted Data (bsc#1199064) Other non security fixes: - Build with Java >= 9 in order to produce a modular jar by compiling the module-info.java sources with all other classes built with release 8 and still compatible with Java 8 - Upgrade to version 2.8.9 (jsc#SLE-24261) * Make OSGi bundle's dependency on sun.misc optional. * Deprecate Gson.excluder() exposing internal Excluder class. * Prevent Java deserialization of internal classes. * Improve number strategy implementation. * Fix LongSerializationPolicy null handling being inconsistent with Gson. * Support arbitrary Number implementation for Object and Number deserialization. * Bump proguard-maven-plugin from 2.4.0 to 2.5.1. * Don't exclude static local classes. * Fix RuntimeTypeAdapterFactory depending on internal Streams class. * Improve Maven build. * Make dependency on java.sql optional. * Fixed issue with recursive types. * Better behavior with Java 9+ and Unsafe if there is a security manager. * EnumTypeAdapter now works better when ProGuard has obfuscated enum fields. * make import of sun.misc optional since not all versions of jdk export it The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-3706,SUSE-SLE-Module-SUSE-Manager-Server-4.1-2022-3706 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223706-1/ Link for SUSE-SU-2022:3706-1 https://lists.suse.com/pipermail/sle-security-updates/2022-October/012637.html E-Mail link for SUSE-SU-2022:3706-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1199064 SUSE Bug 1199064 https://www.suse.com/security/cve/CVE-2022-25647/ SUSE CVE CVE-2022-25647 page SUSE Manager Server Module 4.1 google-gson-2.8.9-150200.3.7.1 google-gson-javadoc-2.8.9-150200.3.7.1 google-gson-2.8.9-150200.3.7.1 as a component of SUSE Manager Server Module 4.1 The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks. CVE-2022-25647 SUSE Manager Server Module 4.1:google-gson-2.8.9-150200.3.7.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223706-1/ https://www.suse.com/security/cve/CVE-2022-25647.html CVE-2022-25647 https://bugzilla.suse.com/1199064 SUSE Bug 1199064