SUSE-SU-2026:4677-1

SUSE-SU-2026:4677-1 · Security update for the Java stack

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

На странице показана часть фактов из источников. Полное описание и список затронутых версий приведены в связанных бюллетенях.

This update for Java fixes the following issues: This update introduces new libraries and refines existing Java tools to improve security, compatibility, stability, and formatting. ant (Updated to version 1.10.18): - Security issues fixed: - CVE-2021-36374: Fixed excessive memory allocation when reading specially crafted ZIP archives or derived formats (bsc#1188469) - CVE-2025-7962: Fixed improper neutralization of line breaks to prevent SMTP injection (bsc#1246873) - CVE-2026-78254: Fixed path traversal in FTP and SCP tasks that could allow arbitrary file writes (bsc#1280015) - Other changes and bugs fixed: * Breaking changes: + FTPS tasks now use encrypted data channels by default. + FTP and SCP tasks now prevent files or directories from being written outside the target directory by default. * Other changes: + Added package `ant-junit5` that allows tests to be launched and run using the JUnit 5 framework. + Improved support for reproducible builds by standardizing timestamps, file modification times, and timezone handling. + Upgraded the jakarta.mail dependency to version 2.0.2. + Added an option to the 'record' task to create log files relative to the project directory. * Bugs fixed: + Fixed compatibility and startup issues when running on newer Java versions. + Fixed network handling issues in FTP and SCP tasks, including proper support for IPv6 addresses. + Improved security in email tasks by verifying TLS server certificates and enforcing STARTTLS encryption. + Improved report generation performance in JUnit launcher tasks. + Fixed regressions and edge cases in resource mapping, path conversion, and command execution. json-simple (Updated to version 2.3.1): - Updated to a newer version that makes reading and writing structured web data (JSON) safer and more reliable. - Added a 'pretty-printing' feature to format web data so it is easier to read. - Made reading and writing data safer when multiple tasks are running simultaneously. - Made looking up data more flexible, allowing the tool to automatically handle different format types (like numbers and text). junit5 (Updated to version 5.14.4): - Fixed an issue where tests could conflict or run incorrectly when executed at the same time. - Corrected test behavior on newer versions of Java so they run reliably. - Improved test reports so that test names are clearer, unique, and easier to distinguish from one another. - Added features to customize how test names are generated and better capture testing outputs. maven-doxia, maven-doxia-sitetools (Updated to version 2.1.0): - Added support for displaying the last modification date and author on generated web pages. - Added support for displaying interactive diagrams (such as flowcharts or charts) directly on web pages. - Improved formatting and layout for modern documents, including better tables, lists, and links. maven-surefire, maven-surefire-plugins (Updated to version 3.5.6): - Fixed a bug that caused software testing tasks to fail abruptly with an unexpected error [bsc#1273185]. - Added timestamps to testing reports so you can see exactly when tests ran. - Made running multiple tests at the same time much more reliable, preventing mixed-up report results. - Added the ability to immediately stop testing once a failure is detected (saving time). objectweb-asm (Updated to version 9.10.1): - Added support for newer Java versions, including bytecode support up to Java 27. - Prevented out-of-memory errors when processing invalid or corrupted class files. - Improved bytecode analysis and verification to correctly handle valid Java code and prevent unexpected analysis errors - Improved compliance with FIPS 140-3 security standards during class serialization. - Corrected package import ranges to prevent dependency conflicts in OSGi environments. - Fixed unexpected crashes and errors in code generation and inspection utilities. plexus-archiver (Updated to version 4.14.0): - Added support for following symbolic links when collecting files for archives. - Reduced memory usage when creating ZIP archives to prevent out-of-memory errors during large builds. - Fixed an issue where reading file attributes on Windows systems could cause unexpected errors. - Improved ZIP archive handling, fixing checksum calculation errors, negative timestamp issues, and file permissions. - Replaced compression components with Apache Commons Compress to eliminate vulnerable dependencies. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated dependencies, including commons-io to 2.22.0, xz to 1.12, and zstd-jni to 1.5.7-15. plexus-build-api (Updated to version 1.2.0): - Updated dependencies for compatibility with modern build and injection tools. plexus-cipher (Updated to version 2.1.0): - Updated dependencies for compatibility with modern build and injection tools. plexus-classworlds (Updated to version 2.12.1): - Fixed file pattern matching (glob matching) when loading classes and resources. - Restored backward compatibility with legacy Maven 2 configurations. - Added support for registering filtered class realms. - Implemented clean resource shutdown support (Closeable) for class loaders. - Added support for the PPC64LE architecture. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated dependencies, including jakarta.xml.bind-api, log4j-api, and ant. plexus-compiler (Updated to version 2.17.1): - Fixed a security issue (Zip Slip) that could allow arbitrary file overwrite during archive extraction. - Fixed an unexpected crash (ConcurrentModificationException) when processing compiler arguments concurrently. - Fixed compiler diagnostics and warning reporting to ensure multi-line messages and warning categories are properly displayed. - Fixed Java version detection when custom options or newer Java versions are present. - Fixed an issue where the Eclipse Java Compiler (ECJ) failed to detect annotation processors configured in the processor path. - Added support for quoting compiler argument files to safely handle paths containing spaces. - Fixed cross-drive file path handling on Windows systems. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated dependencies, including Google Guava to 33.7.1 and Eclipse Java Compiler (ECJ) to 3.46.100. plexus-containers (Updated to version 2.2.0): - Added the plexus-metadata-generator Ant task and command-line interface to generate component metadata. - Added the plexus-metadata-generator-ant package capability. plexus-i18n (Updated to version 1.2.0): - Corrected language translation lookup to prevent unintentionally falling back to the system default locale. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated internal dependencies. plexus-interactivity (Updated to version 1.6.0): - Upgraded the terminal reader dependency to JLine 3 for improved console and terminal interaction. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated dependencies, including Sisu Inject to 1.1.0 and Guice to 5.1.0. plexus-interpolation (Updated to version 1.30.0): - Fixed caching issues in string and regular expression interpolators to significantly improve evaluation performance and consistency. - Added support for feedback value sources and delimiter tracking. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated internal dependencies. plexus-io (Updated to version 3.8.0): - Improved performance by caching Unix user and group lookups. - Fixed file handling to properly follow symbolic links when configured. - Fixed an issue where temporary files were left unclosed, preventing file-not-found errors. - Improved resilience when querying file attributes on network file system

Есть исправление

Опубликовано

2026-10-15T05:56:19Z

Обновлено

2026-10-15T18:00:06.753263208Z

Стек: system

Проверьте свой сервер →