SUSE-SU-2023:1673-1

Details

This update for xstream fixes the following issues:

CVE-2022-40151: Fixed stackoverflow in XML serialization (bsc#1203520).
CVE-2022-41966: Fixed denial of service via uncontrolled recursion during deserialization (bsc#1206729).
Upgrade to 1.4.20.

Affected Packages

xstream

SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

1.4.20-150200.3.25.1

xstream-benchmark

openSUSE Leap 15.4

Fixed in:

1.4.20-150200.3.25.1

xstream-javadoc

openSUSE Leap 15.4

Fixed in:

1.4.20-150200.3.25.1

xstream-parent

openSUSE Leap 15.4