xstream-benchmark-1.4.20-150200.3.25.1 < > , Q dp9| g(IOb~ ~>}yqtӉ.5:qR MK q=E \\Y*JJ /3o9l9f>&
]fa#_CL8 SH0gI[;~v"nēMworQP'h`;K66bl{K)Q'Vy-Wj; .&N
?wj us+d=:*}!?cS2 > > *x ? *h d ) J ( . 8 T b
p S
8 ( 8 9 $ : & F % G % H & I &( X &0 Y &@ \ &l ] & ^ ' b ' c (2 d ( e ( f ( l ( u ( v ( w ) x ) y ) z * * * *" *d C xstream-benchmark 1.4.20 150200.3.25.1 The benchmark module for xstream This package contains the benchmark module for xstream. dsheep27 SUSE Linux Enterprise 15 SUSE LLC BSD-3-Clause https://www.suse.com/ Development/Libraries/Java https://x-stream.github.io/ linux noarch g3 AA ddddddd fddd1c5bd59659b93341b9e51de11ded65b164d6bf87bda72354d9f699014bd6 e32d3ed1516939cca83dd54eeb1fd8648232b3305fdef40f75aa78a2a01964ab be1236d91fa93db4532a5143c1a949a2a8fa42f879f2917fe2c2007257becbff xstream/xstream-benchmark.jar xstream/xstream-benchmark.pom root root root root root root root root root root root root root root xstream-1.4.20-150200.3.25.1.src.rpm mvn(com.thoughtworks.xstream:xstream-benchmark) mvn(com.thoughtworks.xstream:xstream-benchmark:pom:) osgi(xstream-benchmark) xstream-benchmark @ @ @
java-headless javapackages-filesystem mvn(com.thoughtworks.xstream:xstream) rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) xstream 1.8 1.4.20 3.0.4-1 4.6.0-1 4.0-1 5.2-1 1.4.20-150200.3.25.1 4.14.1 dV@bDF@b4t@a@aS``x*`Gc@\~d\Yz\Z!D@Z@WVn@VA@fstrba@suse.com fstrba@suse.com fstrba@suse.com fstrba@suse.com fstrba@suse.com fstrba@suse.com fstrba@suse.com jrenner@suse.com fkobzik@suse.com michele.bologna@suse.com moio@suse.com mc@suse.com jgonzalez@suse.com moio@suse.com moio@suse.com moio@suse.com - Upgrade to 1.4.20
* Security fixes
+ This maintenance release addresses the security
vulnerabilities CVE-2022-40151 (bsc#1203520) and
CVE-2022-41966 (bsc#1206729), causing a Denial of Service by
raising a stack overflow. It also provides new converters for
Optional and Atomic types.
* Major changes
+ #308: Add converter for AtomicBoolean, AtomicInteger,
AtomicLong, and AtomicReference of package
java.util.concurrent.atomic.
+ #293: Add converter for Optional, OptionalDouble, OptionalInt,
and OptionalLong of package java.util.
* Minor changes
+ #287: Close stream opened from provided URL.
+ #284: Fix disabling check against hash code attack with
XStream.setCollectionUpdateLimit(0).
* Stream compatibility
+ The atomic types with new converters of package
java.util.concurrent.atomic, that have been written with
previous versions of XStream, can still be deserialized.
+ The Optional types with new converters of package java.util,
that have been written with previous versions of XStream,
can still be deserialized.
+ The WildcardTypePermission allows by default no longer
anonymous class types.
* API changes
+ Added c.t.x.converters.extended.AtomicBooleanConverter.
+ Added c.t.x.converters.extended.AtomicIntegerConverter.
+ Added c.t.x.converters.extended.AtomicLongConverter.
+ Added c.t.x.converters.extended.AtomicReferenceConverter.
+ Added c.t.x.converters.extended.OptionalConverter.
+ Added c.t.x.converters.extended.OptionalDoubleConverter.
+ Added c.t.x.converters.extended.OptionalIntConverter.
+ Added c.t.x.converters.extended.OptionalLongConverter.
+ Added c.t.x.security.WildcardTypePermission
.WildcardTypePermission(boolean,String[]). - Build against the standalone JavaEE modules unconditionally - Build against standalone activation-api and jaxb-api on systems
where the JavaEE modules are not part of JDK - Upgrade to 1.4.19
* Security fixes
+ This maintenance release addresses the security vulnerability
CVE-2021-43859, bsc#1195458, when unmarshalling highly
recursive collections or maps causing a Denial of Service.
* API changes
+ Added c.t.x.XStream.COLLECTION_UPDATE_LIMIT and
c.t.x.XStream.COLLECTION_UPDATE_SECONDS.
+ Added c.t.x.XStream.setCollectionUpdateLimit(int).
+ Added c.t.x.core.SecurityUtils.
+ Added c.t.x.security.AbstractSecurityException and
c.t.x.security.InputManipulationException.
+ c.t.x.security.InputManipulationException derives now from
c.t.x.security.AbstractSecurityException. - Upgrade to 1.4.18
* Security fixes
+ This maintenance release addresses following security
vulnerabilities, when unmarshalling with an XStream instance
using the default blacklist of an uninitialized security
framework. XStream is therefore now using a whitelist by
default. (CVE-2021-39139, CVE-2021-39140, CVE-2021-39141,
CVE-2021-39144, CVE-2021-39145, CVE-2021-39146,
CVE-2021-39147, CVE-2021-39148, CVE-2021-39149,
CVE-2021-39150, CVE-2021-39151, CVE-2021-39152,
CVE-2021-39153, CVE-2021-39154, bsc#1189798)
* Minor changes
+ Support serializable types with non-serializable parent with
PureJavaReflectionConverter.
* Stream compatibility
+ Starting with version 1.14.12 nine years ago, XStream contains
a Security Framework to implement a black- or whitelist for
the allowed types at deserialization time. Until version
1.4.17, XStream kept a default blacklist in order to deny all
types of the Java runtime, which are used for all kinds of
security attacks, in order to guarantee optimal runtime
compatibility for existing users. However, this approach has
failed. The last months have shown, that the Java runtime
alone contains dozens of types that can be used for an attack,
not even looking at the 3rd party libraries on a classpath.
The new version of XStream uses therefore now by default a
whitelist, which is recommended since nine years. It also has
been complaining on the console for a long time about an
uninitialized security framework the first time it was run.
Anyone who has followed the advice and initialized the
security framework for their own scenario can easily update
to the new version without any problem. Everyone else will
have to do a proper initialization now, otherwise the new
version will fail with certainty at deserialization time.
- Modified patch:
* Revert-MXParser-changes.patch
+ rediff to changed context - Upgrade to 1.4.17
* Security fix:
* bsc#1186651, CVE-2021-29505: potential code execution when
unmarshalling with XStream instances using an uninitialized
security framework - Upgrade to 1.4.16
* Security fixes:
+ bsc#1184796, CVE-2021-21351: remote attacker to load and
execute arbitrary code
+ bsc#1184797, CVE-2021-21349: SSRF can lead to a remote
attacker to request data from internal resources
+ bsc#1184380, CVE-2021-21350: arbitrary code execution
+ bsc#1184374, CVE-2021-21348: remote attacker could cause
denial of service by consuming maximum CPU time
+ bsc#1184378, CVE-2021-21347: remote attacker to load and
execute arbitrary code from a remote host
+ bsc#1184375, CVE-2021-21344: remote attacker could load and
execute arbitrary code from a remote host
+ bsc#1184379, CVE-2021-21342: server-side forgery
+ bsc#1184377, CVE-2021-21341: remote attacker could cause a
denial of service by allocating 100% CPU time
+ bsc#1184373, CVE-2021-21346: remote attacker could load and
execute arbitrary code
+ bsc#1184372, CVE-2021-21345: remote attacker with sufficient
rights could execute commands
+ bsc#1184376, CVE-2021-21343: replace or inject objects, that
result in the deletion of files on the local host
- Add patch:
* Revert-MXParser-changes.patch
+ revert changes that would force us to add new dependency - Upgrade to 1.4.15
* fixes bsc#1180146, CVE-2020-26258 and bsc#1180145,
CVE-2020-26259
- Upgrade to 1.4.14
* fixes bsc#1180994, CVE-2020-26217
- Update xstream to 1.4.15~susemanager
Removed:
* xstream_1_4_10-jdk11.patch
* xstream_1_4_10-buildsh-sle12.patch
* build.sh - Update xstream to 1.4.10
Added:
* xstream_1_4_10-jdk11.patch
* xstream_1_4_10-buildsh-sle12.patch
* xstream-XSTREAM_1_4_10.tar.gz
Removed:
* 0001-Prevent-deserialization-of-void.patch
* xstream-XSTREAM_1_4_9.tar.gz
* xstream-XSTREAM_1_4_9-jdk11.patch
- Major changes:
- New XStream artifact with -java7 appended as version suffix for a library explicitly without the Java 8 stuff (lambda expression support, converters for java.time.* package).
- Fix PrimitiveTypePermission to reject type void to prevent CVE-2017-7957 with an initialized security framework.
- Improve performance by minimizing call stack of mapper chain.
- XSTR-774: Add converters for types of java.time, java.time.chrono, and java.time.temporal packages (converters for LocalDate, LocalDateTime, LocalTime, OffsetDateTime, and ZonedDateTime by Matej Cimbora).
- JavaBeanConverter does not respect ignored unknown elements.
- Add XStream.setupDefaultSecurity to initialize security framework with defaults of XStream 1.5.x.
- Emit error warning if security framework has not been initialized and the XStream instance is vulnerable to known exploits. - Feat: modify patch to be compatible with JDK 11 building
Added:
* xstream-XSTREAM_1_4_9-jdk11.patch
Removed:
* xstream-XSTREAM_1_4_9-jdk9.patch - fixes for SLE 15 compatibility - fix possible Denial of Service when unmarshalling void.
(CVE-2017-7957, bsc#1070731)
Added:
* 0001-Prevent-deserialization-of-void.patch - Fix build for JDK9
- Disable javadoc generation (broken for SLE15 and Tumbleweed)
- Add:
* xstream-XSTREAM_1_4_9-jdk9.patch
- Changed:
* build.sh - Require building on Java 8, otherwise the LambdaMapper class is skipped
(issue 30) - Upgrade to version 1.4.9, which fixes CVE-2016-3674 (bsc#972950) - Initial version sheep27 1679301532 1.4.20 1.4.20 1.4.20 1.4.20-150200.3.25.1 xstream xstream-benchmark.jar xstream-benchmark.jar xstream-xstream-benchmark.xml xstream xstream-benchmark.pom xstream-benchmark.pom /usr/share/java/ /usr/share/java/xstream/ /usr/share/maven-metadata/ /usr/share/maven-poms/ /usr/share/maven-poms/xstream/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:28299/SUSE_SLE-15-SP2_Update/d005eaebf3850fd413a04fc4ee710da3-xstream.SUSE_SLE-15-SP2_Update drpm xz 5 noarch-suse-linux directory ASCII text, with CRLF line terminators (Zip archive data, at least v2.0 to extract Zip archive data, at least v2.0 to extract) XML 1.0 document, ASCII text exported SGML document, ASCII text P P P R R R Z.˃
Ds utf-8 83149874585cd5708ea56799ea81dd1477daa8414018f05b64c0db41b9375d21 ? 7zXZ
! t/J# ] "k%]ס%$X;VL` Wm:WG`N mWM*ix1JʐQ} %լUǚA
uO0 ̓5la|* h{!MRt)5=#/*A+kVO2q. 4% Z
<[\;̰*hæ6顈Ҙzɋxl3c7Ϝu z\ܑp RwG8ݼ 3
x40@pۮmJ\9o tA)'KYxqK % H ۚE)H4X `$MҍVSTnwR2mg|$e*
f{=w 5k<|adt@`dvO+ʐl1Rd4)3R܍dmW_jJ,HUgdA#OUjɶ 亸5Q?420α/ڒ ~֟W T Jt'=xؙVAoMa=
{vSi8GX'-ZI!2p _H 17 2F~gKSts̰X=AA6+Zo(FWq6,pߺ
5 1 01Q'u^"GìrF7`bFSfkKZs:P<-@9|wHr
_6Rf7n& !
ߔ(H[#^:k|f/W=iY<*@N Rq1N
XJ+r~m}![\)_% Z~%l+jrwPR5Msؾ/e +@}
KuW8rY 'ZEw%_[~Q\OVf 0MpoZEVSuG&0?[̘-
2!FB °l2{x(f2jEʪٲ[ L D2=e%A뎎t: O 4MgwFsQ0; 6^l4c\d,i pX^ Ñ|^udl[ v6\ ( !!*'=nTVU!bPtY5LvE ˒aN-3vAtD!V8
,\RfsK D>c_K69?,:=<1;3Wq` 1I1=QZx_] 4>+BҟqA {kiCȣ h;x=f7"寧|:\+S2℣8h"u-.ku&\ eE%akG7<34$.@|S+\LzIqbA5D
t ᲩTJz _ ˽J\0h~G81qUU,I0Nkap_Uw-W)BǪwmP7都R
?[jYm5Ad a!5AӃ($h\ߗF)Rq:VΕ@hr
JDYȋR>YS]8qαIrdœGwi≼TuvA!64RBe7ZtՀ<\ "$.de:?#w*R.חZXO !bw^?('y-(u{>$DlM/p
Ʒ#|d+ j*=h=Mb%]k] 0?
:#vEd71X$+ xҠ#.QkJ/D-%" qk.ˡp<}qY>*Ф';3VzB)V#LVԏreZB٘_ rllH]ʒ|C ua oIj09E ,=-
ݬڃ@_L,`eEɹÍ
[E>c87\@/z aB"?!nU+vLs:7?zH;r
̻I1](a*ؔLRFy(>-_(HJW%woz4[QEH113ĸ3jqYv?
xoNZ#8@cW#ŀaB%~4@ׄRY#'QKD! Řz=1BJ09 8 8=%UAORAǂY) osM+eK ȹ#u ͘h{dgB˪|F?0<)3Z HH /I#I["ɄI>!cC 5hi֢>.i>]7J|襭t$ 126}=ep:ee$.ϮI`}BqHcW )A5-D`#-豯Ep)P z| TDzLԓʼ0qx#}L^
aȹq"W' p6Y؝WfQeJNԉI S {[xOb j]zD;ߩʭ5N/EgeD!2| KJznI 0"{h?(| kvxD$~ ј g@ٵb1'CDlT Ӻ7ct~ uaPǬ8
#Y4~jT)yyPzm`sYFS8t@P\܅1ul Cyxs۪5h 0^ _zL$ з`U6!Y?9*gAʍZK$hU{}* ƞ*|"!Әe$M3`F#W~.uEO
Y[KφFzveAE {s%_PAq VHKpwZr$`^`,nNO cusvwNpq{
l2w )BP #"Am:n3O'^`bR*iN)i9ƣ[K>obZГw w +ϿmW I=N{lns8"5|]Nf!cn2fjCfov4)&6+/ь,fcG702?N; iod1 6WD51&%DCh^!/qؓpYG8Ûki3ΡտPR
mTDl/$y?DըWu9}$k_.;aoWbxmakg>h U }f7
/%{9 vg`: Ale C'M
HMXUQ_;76]%qeU5*{I-eLnSvv'﹎g 䲁Y}41$n')YX/*
;z@$[UIeM-v;.ylhݦrg wq)Ķ)_s$\ل"QDء_RL l(lHy
#u *tHr a.h<_vMQtlqɈ)B$yt.8_`v{gq"LiB E nα-`ܫ'2ʡլWCWu 5P?h֧3pSa8c| < 2"p4&fA'sZ!F@t;k*lc? Ba ͢T)`/̱#^2
^e3 P֎Ǟ>cr"]4,|a.Y ~hr ~-BhEH-6h Ci~H=#;#**?:vSyIG"s>>*ɼ־GЩ`~+ W,2vF'fIQax'.[G ~"ߺs>`n8y1b MS0>p6$^xЬwJ#Se,b{22
Qc{ N n#WJ$;AR)j ʜћxHg "bMdJ-ΏFjE#q+<mdt3t %K:WE-v?-$Օ`Y( &s Q%yAx m4֏5%!WC9f 0`避4YAImገs(t1rX}9td)e&:IaHYFtoO뜍l +AHuİ&rP ::U@ؗ쇎J]?*NMGik;8HIeu ~&jK.t_(4R>h A7 } ;Qf zPTJ6Gܥ^Mb{rk
#-R//OmS5Fz$ΰ&fաQ'j zߔ_wuOς.?sD: p >_Ɓύ!|wOM廿ˆDIn@3V~,aS[! <
Hjg̟roatb*ϼ~m4v@R='}tp{=#u_)GȦX^ƈgt`OM%$ }ͦ[! #@kokIg-ѩ Q'\>VlE?)@~T3DjkHgÍ$jMC*,r__/ftFů6ה`S/6cVtg:6Xls qf-Òq+^j5wfK wgʹ+G ?)9, nkR5_qGv_i
_i^&sµL=H("}L_ꛧ
X }Nl1*UXpv]0پ/q #k"Mo1*iPg(F\\c Yl!'YO646lbu]Ď #s$1g`'.E;(j8&l݊1a
P wѤg2L+o7!m.. m|ϴ ]-ÞG 542YRX/bF0q`4d. 3
.X?N,c^3/z4_ݚ? =$d/1ㆬ')`.[2ΰgpyZɮq)%I 3=#fO3AKYF@\47<4wW@9*g|9qU&̖>Č8 ë%נ]=t6 1W*f3uAkI|tnƙ?ɺHI[Iq^{%p%24 +ba.8!YKpm3vƽ
)u< [=O
-mx23Qτ;cC 0 4$GN< Ojn l)sqâi%Wk2noRFI0El<YjReGzzAk)nO+ؚeۥU
v)J%ggu2Te|ysPoL"sK.,mҒ . R;\V9%Z|/~tS3N龀WO_ #*X Q Y ߮$L{4~. =G
Fd dqG4
td(]To}ܑi! 7 Z0$%a[I[J; jC<*^lI3|NuH{8>`P-15>%itIG4p 3(&Th ]!v!4oyE; Qt#{Wh8Y + q3QbV2
-l X7pF[l A12K=IUիsn
^
Yz rS/='Ѭ{A.ּ ',1cs~GSG@|,JS,iDZgt3t +˦NxIX \&,1^@|7k&]a=jj$T *b;D (hqګ K-뿼qEX 5Ijb
A҃aפ8*fw_yK|S@Ne*7_, F ^uA^)dǗ=\vb/m;@ K2b3jAx]^#镰:A{cQ
*&fRq=s;}0<5jF+nMu
\)'S* Tym s ?DR0(0
gQqm3^goH+LXB q?řHӂϦJ5HAίU*cđe-hᣱ6EY)[+k g8 (䮄
/KI~ӊ3MT~y\M3]-wL&s%\~js 0Ex/QPj)[NY}\&l?YE®ֈ!i"I؋i.B?/Oe.V҇F_w28$+dc_"$X w٬B~_ai<:7ROU0)^]{AKQG3ru]6mPB@!O1 ح;mUC&'IcΛҹ~˵7LLx_fïIRePSN>` 7@WRH;UiP0%\]X&0l)s O Aitmj/^NWHY
ACb`CJ>tm9
wqS|;z TYt(d\Hej]%2VƒZ&Eu%ck)$/>u}=]RVH'/(e]?#uc EvzQ~0̾"0