ALT Linux Team

Package google-gson update in sisyphus on 2022-07-02

ALT-PU-2022-2164-2

Package google-gson updated to version 2.9.0-alt1_1jpp11 for branch sisyphus in task 303046.

Closed vulnerabilities

Published: 2023-12-22
Modified: 2024-01-11

BDU:2023-09014

Уязвимость пакета com.google.code.gson:gson библиотеки Gson, позволяющая нарушителю выполнить атаку типа «отказ в обслуживании» (DoS)

Severity: HIGH (7.7)Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Severity: HIGH (7.3)Vector: AV:N/AC:H/Au:N/C:P/I:C/A:C
References:
Published: 2022-05-01
Modified: 2024-11-21

CVE-2022-25647

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Severity: HIGH (7.5)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
Published: 2022-05-03
Modified: 2022-05-20

GHSA-4jrv-ppp4-jm57

Deserialization of Untrusted Data in Gson

Severity: HIGH (7.7)Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
References:
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: 2.1.2
Back to top