Markus Koschany pushed to branch master at Debian Java Maintainers / libxstream-java
Commits: 494f9a3d by Hideki Yamane at 2021-06-17T22:47:55+00:00 patch for CVE-2021-29505 - - - - - eb57551f by Markus Koschany at 2021-06-17T22:47:56+00:00 Merge branch 'master' into 'master' patch for CVE-2021-29505 See merge request java-team/libxstream-java!1 - - - - - 3 changed files: - debian/changelog - + debian/patches/0004-Fix-CVE-2021-29505-from-upstream-commit-Closes-98949.patch - debian/patches/series Changes: ===================================== debian/changelog ===================================== @@ -1,3 +1,15 @@ +libxstream-java (1.4.15-3) unstable; urgency=medium + + * Team upload. + * debian/patches + - Add 0004-Fix-CVE-2021-29505-from-upstream-commit-Closes-98949.patch to + deal with CVE-2021-29505 (Closes: 98949) + + For more detail, see + https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc + + -- Hideki Yamane <[email protected]> Thu, 17 Jun 2021 21:45:48 +0900 + libxstream-java (1.4.15-2) unstable; urgency=high * Team upload. ===================================== debian/patches/0004-Fix-CVE-2021-29505-from-upstream-commit-Closes-98949.patch ===================================== @@ -0,0 +1,38 @@ +From: Hideki Yamane <[email protected]> +Date: Thu, 17 Jun 2021 21:42:35 +0900 +Subject: Fix CVE-2021-29505 from upstream commit (Closes:#989491) + +See https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227 +--- + xstream/src/java/com/thoughtworks/xstream/XStream.java | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/xstream/src/java/com/thoughtworks/xstream/XStream.java b/xstream/src/java/com/thoughtworks/xstream/XStream.java +index b5e43af..7a166ca 100644 +--- a/xstream/src/java/com/thoughtworks/xstream/XStream.java ++++ b/xstream/src/java/com/thoughtworks/xstream/XStream.java +@@ -336,11 +336,13 @@ public class XStream { + private static final Pattern IGNORE_ALL = Pattern.compile(".*"); + private static final Pattern GETTER_SETTER_REFLECTION = Pattern.compile(".*\\$GetterSetterReflection"); + private static final Pattern PRIVILEGED_GETTER = Pattern.compile(".*\\$PrivilegedGetter"); ++ private static final Pattern LAZY_ENUMERATORS = Pattern.compile(".*\\.Lazy(?:Search)?Enumeration.*"); + private static final Pattern LAZY_ITERATORS = Pattern.compile(".*\\$LazyIterator"); + private static final Pattern JAXWS_ITERATORS = Pattern.compile(".*\\$ServiceNameIterator"); + private static final Pattern JAVAFX_OBSERVABLE_LIST__ = Pattern.compile( + "javafx\\.collections\\.ObservableList\\$.*"); + private static final Pattern JAVAX_CRYPTO = Pattern.compile("javax\\.crypto\\..*"); ++ private static final Pattern JAVA_RMI = Pattern.compile("(?:java|sun)\\.rmi\\..*"); + private static final Pattern BCEL_CL = Pattern.compile(".*\\.bcel\\..*\\.util\\.ClassLoader"); + + /** +@@ -657,8 +659,8 @@ public class XStream { + "sun.awt.datatransfer.DataTransferer$IndexOrderComparator", // + "sun.swing.SwingLazyValue"}); + denyTypesByRegExp(new Pattern[]{ +- LAZY_ITERATORS, GETTER_SETTER_REFLECTION, PRIVILEGED_GETTER, JAVAX_CRYPTO, JAXWS_ITERATORS, +- JAVAFX_OBSERVABLE_LIST__, BCEL_CL}); ++ LAZY_ITERATORS, LAZY_ENUMERATORS, GETTER_SETTER_REFLECTION, PRIVILEGED_GETTER, JAVA_RMI, JAVAX_CRYPTO, ++ JAXWS_ITERATORS, JAVAFX_OBSERVABLE_LIST__, BCEL_CL}); + denyTypeHierarchy(InputStream.class); + denyTypeHierarchyDynamically("java.nio.channels.Channel"); + denyTypeHierarchyDynamically("javax.activation.DataSource"); ===================================== debian/patches/series ===================================== @@ -1,3 +1,4 @@ 01-java7-compatibility.patch 02-disable-beastax-driver.patch CVE-2021-21341-to-CVE-2021-21351.patch +0004-Fix-CVE-2021-29505-from-upstream-commit-Closes-98949.patch View it on GitLab: https://salsa.debian.org/java-team/libxstream-java/-/compare/c19460247bcfcca9eb124fcd9abddd7f4e7116d9...eb57551f19b0cab40647e77e64f756f22e9c300a -- View it on GitLab: https://salsa.debian.org/java-team/libxstream-java/-/compare/c19460247bcfcca9eb124fcd9abddd7f4e7116d9...eb57551f19b0cab40647e77e64f756f22e9c300a You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ pkg-java-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-commits
