SUSE-SU-2024:4407-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2024:4407-1

MEDIUM4.1

Security update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative

Published Dec 23, 2024

Modified 1 months ago

Fix available

Details

Description of the patch:

This update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative fixes the following issues:

CVE-2024-47535: Fixed unsafe reading of large environment files when Netty is loaded by a java application can lead to a crash due to the JVM memory limit being exceeded in netty (bsc#1233297)

Other fixes:

Upgraded netty to upstream version 4.1.115
Upgraded netty-tcnative to version 2.0.69 Final
Updated jctools to version 4.0.5
Updated aalto-xml to version 1.3.3
Updated moditect to version 1.2.2
Updated flatten-maven-plugin to version 1.6.0

Affected Packages

netty-tcnative

SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise Module for Development Tools 15 SP5SUSE Linux Enterprise Module for Development Tools 15 SP6

Fixed in:

0:2.0.69-150200.3.22.1

jctools

SUSE Linux Enterprise Module for Package Hub 15 SP5SUSE Linux Enterprise Module for Package Hub 15 SP6openSUSE Leap 15.5openSUSE Leap 15.6

Fixed in:

0:4.0.5-150200.3.9.1

netty

SUSE Linux Enterprise Module for Package Hub 15 SP5SUSE Linux Enterprise Module for Package Hub 15 SP6openSUSE Leap 15.5openSUSE Leap 15.6

Fixed in:

0:4.1.115-150200.4.26.1

netty-javadoc

SUSE Linux Enterprise Module for Package Hub 15 SP5SUSE Linux Enterprise Module for Package Hub 15 SP6openSUSE Leap 15.5openSUSE Leap 15.6