Ubuntu
libxstream-java package

libxstream-java 1.4.19-1ubuntu0.1 source package in Ubuntu

Changelog

libxstream-java (1.4.19-1ubuntu0.1) kinetic-security; urgency=medium

  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2022-41966.patch: XStream serializes Java objects to
      XML and back again. Prior versions may allow a remote attacker to
      terminate the application with a stack overflow error, resulting in a
      denial of service only via manipulation of the processed input stream.
      The attack uses the hash code implementation for collections and maps
      to force recursive hash calculation causing a stack overflow. This
      issue is patched in this version which handles the stack overflow and
      raises an InputManipulationException instead. A potential workaround
      for users who only use HashMap or HashSet and whose XML refers these
      only as default map or set, is to change the default implementation of
      java.util.Map and java.util per the code example in the referenced
      advisory. However, this implies that your application does not care
      about the implementation of the map and all elements are comparable.
      (Closes: #1027754)
    - CVE-2022-41966

 -- Amir Naseredini <email address hidden>  Tue, 07 Mar 2023 11:53:30 +0000

Upload details

Uploaded by:
Amir Naseredini
Uploaded to:
Kinetic
Original maintainer:
Ubuntu Developers
Architectures:
all
Section:
java
Urgency:
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section
Kinetic updates universe libs
Kinetic security universe libs

Builds

Kinetic: [FULLYBUILT] amd64

Downloads

File Size SHA-256 Checksum
libxstream-java_1.4.19.orig.tar.xz 463.1 KiB 7bc71cb4d421c6270a1824aa617c14b29b46cfef27ab924855f94f1674632628
libxstream-java_1.4.19-1ubuntu0.1.debian.tar.xz 18.8 KiB 4bd3cd9790184a4b9e17f178e8defe93fb56c501ee6a659291e0209e760b101a
libxstream-java_1.4.19-1ubuntu0.1.dsc 2.3 KiB 3bb3d0d2eb4397b209873b2256f8718213dbaeb1f024e9a3a80e8e64eb390890

View changes file

Binary packages built by this source

libxstream-java: Java library to serialize objects to XML and back again

 The features of the XStream library are:
 .
  - Ease of use. A high level facade is supplied that simplifies common
    use cases.
  - No mappings required. Most objects can be serialized without need
    for specifying mappings.
  - Performance. Speed and low memory footprint are a crucial part of
    the design, making it suitable for large object graphs or systems
    with high message throughput.
  - Clean XML. No information is duplicated that can be obtained via
    reflection. This results in XML that is easier to read for humans
    and more compact than native Java serialization.
  - Requires no modifications to objects. Serializes internal fields,
    including private and final. Supports non-public and inner classes.
    Classes are not required to have default constructor.
  - Full object graph support. Duplicate references encountered in the
    object-model will be maintained. Supports circular references.
  - Integrates with other XML APIs. By implementing an interface,
    XStream can serialize directly to/from any tree structure (not just
    XML).
  - Customizable conversion strategies. Strategies can be registered
    allowing customization of how particular types are represented as
    XML.
  - Error messages. When an exception occurs due to malformed XML,
    detailed diagnostics are provided to help isolate and fix the
    problem.
  - Alternative output format. The modular design allows other output
    formats. XStream ships currently with JSON support and morphing.