<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: 0.875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px;
}
body {
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";'>
<div class="content">
<h3 style="margin-top: 20px; margin-bottom: 10px;">
Markus Koschany pushed to branch jessie at <a href="https://salsa.debian.org/java-team/libxstream-java">Debian Java Maintainers / libxstream-java</a>
</h3>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Commits:
</h4>
<ul>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/libxstream-java/-/commit/0fe9b951b51c333112b3644aa3547b215fd14418">0fe9b951</a></strong>
<div>
<span> by Emmanuel Bourg </span> <i> at 2015-04-29T17:51:52+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fafafa; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dbdbdb;'>Initial upstream branch.
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/libxstream-java/-/commit/98bc0c12371693b64c5aa884c74e1653e2321c12">98bc0c12</a></strong>
<div>
<span> by Emmanuel Bourg </span> <i> at 2015-04-29T18:03:05+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fafafa; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dbdbdb;'>Imported Upstream version 1.4.8</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/libxstream-java/-/commit/950f48b650ace422000ac9d74dbb238ae3cd4525">950f48b6</a></strong>
<div>
<span> by Emmanuel Bourg </span> <i> at 2016-03-29T11:26:25+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fafafa; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dbdbdb;'>Imported Upstream version 1.4.9</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/libxstream-java/-/commit/e1a339d2d79042d1f33028d53a422d8d9d031059">e1a339d2</a></strong>
<div>
<span> by Emmanuel Bourg </span> <i> at 2017-06-20T10:19:55+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fafafa; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dbdbdb;'>New upstream version 1.4.10</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/libxstream-java/-/commit/3e39d696da29e234129db8bdcab034aa806a7a63">3e39d696</a></strong>
<div>
<span> by Markus Koschany </span> <i> at 2018-11-10T22:39:01+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fafafa; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dbdbdb;'>New upstream version 1.4.11</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/libxstream-java/-/commit/a6a98eb49725b56d0b0c1b28654ecb9ee2fcad06">a6a98eb4</a></strong>
<div>
<span> by Markus Koschany </span> <i> at 2018-11-11T00:04:28+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fafafa; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dbdbdb;'>New upstream version 1.4.11.1</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/libxstream-java/-/commit/eb8197f69e64af8e9a83118b2758a77bd5240d26">eb8197f6</a></strong>
<div>
<span> by Markus Koschany </span> <i> at 2023-01-26T23:34:32+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fafafa; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dbdbdb;'>Import Debian changes 1.4.11.1-1+deb8u6
libxstream-java (1.4.11.1-1+deb8u6) jessie-security; urgency=high
..
* Non-maintainer upload by the ELTS team.
* Fix CVE-2022-41966:
XStream serializes Java objects to XML and back again. Versions prior to
1.4.11.1-1+deb8u6 may allow a remote attacker to terminate the application
with a stack overflow error, resulting in a denial of service only via
manipulation of the processed input stream. The attack uses the hash code
implementation for collections and maps to force recursive hash calculation
causing a stack overflow. This issue is patched in version
1.4.11.1-1+deb8u6 which handles the stack overflow and raises an
InputManipulationException instead.
* Enforce OpenJDK 7 to build libxstream-java.
..
libxstream-java (1.4.11.1-1+deb8u5) jessie-security; urgency=high
..
* Non-maintainer upload by the ELTS team.
* CVE-2021-43859: Prevent a potential remote denial of service (DoS) attack
that could have consumed 100% of the CPU resources. Xstream now monitors
and accumulates the time it takes to add elements to collections and throws
an exception if a set threshold is exceeded.
..
libxstream-java (1.4.11.1-1+deb8u4) jessie-security; urgency=high
..
* Non-maintainer upload by the ELTS team.
* Enable the security whitelist by default to prevent RCE vulnerabilities.
XStream no longer uses a blacklist because it cannot be secured for general
purpose.
..
libxstream-java (1.4.11.1-1+deb8u3) jessie-security; urgency=high
..
* Non-maintainer upload by the ELTS Security Team.
* CVE-2021-29505: a remote attacker may get sufficient rights to execute
commands of the host only by manipulating the processed input stream.
..
libxstream-java (1.4.11.1-1+deb8u2) jessie-security; urgency=high
..
* Non-maintainer upload by the ELTS team.
* Fix CVE-2021-21341 to CVE-2021-21351:
In XStream there is a vulnerability which may allow a remote attacker to
load and execute arbitrary code from a remote host only by manipulating the
processed input stream.
..
The type hierarchies for java.io.InputStream, java.nio.channels.Channel,
javax.activation.DataSource and javax.sql.rowsel.BaseRowSet are now
blacklisted as well as the individual types
com.sun.corba.se.impl.activation.ServerTableEntry,
com.sun.tools.javac.processing.JavacProcessingEnvironment$NameProcessIterator,
sun.awt.datatransfer.DataTransferer$IndexOrderComparator, and
sun.swing.SwingLazyValue. Additionally the internal type
Accessor$GetterSetterReflection of JAXB, the internal types
MethodGetter$PrivilegedGetter and ServiceFinder$ServiceNameIterator of
JAX-WS, all inner classes of javafx.collections.ObservableList and an
internal ClassLoader used in a private BCEL copy are now part of the
default blacklist and the deserialization of XML containing one of the two
types will fail. You will have to enable these types by explicit
configuration, if you need them.
..
libxstream-java (1.4.11.1-1+deb8u1) jessie-security; urgency=high
..
* Team upload.
* Fix CVE-2020-26258:
XStream is vulnerable to a Server-Side Forgery Request which can be
activated when unmarshalling. The vulnerability may allow a remote attacker
to request data from internal resources that are not publicly available
only by manipulating the processed input stream.
* Fix CVE-2020-26259:
Xstream is vulnerable to an Arbitrary File Deletion on the local host when
unmarshalling. The vulnerability may allow a remote attacker to delete
arbitrary known files on the host as long as the executing process has
sufficient rights only by manipulating the processed input stream.
..
libxstream-java (1.4.11.1-1+deb10u1) buster-security; urgency=high
..
* Team upload.
* Fix CVE-2020-26217:
It was found that XStream is vulnerable to Remote Code Execution. The
vulnerability may allow a remote attacker to run arbitrary shell commands
only by manipulating the processed input stream. Users who rely on
blocklists are affected (the default in Debian). We strongly recommend to
use the whitelist approach of XStream's Security Framework because there
are likely more class combinations the blacklist approach may not address.
..
libxstream-java (1.4.11.1-1) unstable; urgency=medium
..
* Team upload.
* New upstream version 1.4.11.1.
..
libxstream-java (1.4.11-1) unstable; urgency=medium
..
* Team upload.
* New upstream version 1.4.11.
* Switch to compat level 11.
* Declare compliance with Debian Policy 4.2.1.
* Build-depend on libjaxb-api-java to fix FTBFS with Java 11.
(Closes: #912377)
* Add a new maven rule for xpp3 to fix a FTBFS.
* Remove Damien Raude-Morvan from Uploaders. (Closes: #889445)
..
libxstream-java (1.4.10-1) unstable; urgency=medium
..
* New upstream release
- Removed CVE-2017-7957.patch (fixed upstream)
* Standards-Version updated to 3.9.8
* Switch to debhelper level 10
..
libxstream-java (1.4.9-2) unstable; urgency=medium
..
* Fixed CVE-2017-7957: Attempts to create an instance of the primitive
type 'void' during unmarshalling lead to a remote application crash.
(Closes: #861521)
..
libxstream-java (1.4.9-1) unstable; urgency=medium
..
* New upstream release
- Fixes CVE-2016-3674: XML External Entity vulnerability (Closes: #819455)
- Ignore the new xstream-jmh module
- Updated the Maven rules
* No longer build the xstream-benchmark module (never used in Debian)
* Build with maven-debian-helper
* Depend on libcglib-nodep-java instead of libcglib3-java
* Standards-Version updated to 3.9.7 (no changes)
* Use secure Vcs-* fields
* Updated the old references to codehaus.org
..
libxstream-java (1.4.8-1) unstable; urgency=medium
..
* New upstream release
* Added a patch to compile with Java 7
* Moved the package to Git
</pre>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
30 changed files:
</h4>
<ul>
<li class="file-stats">
<a href="#24139dae656713ba861751fb2c2ac38839349a7a">
<span class="new-file">
+
.gitattributes
</span>
</a>
</li>
<li class="file-stats">
<a href="#a5cc2925ca8258af241be7e5b0381edf30266302">
<span class="new-file">
+
.gitignore
</span>
</a>
</li>
<li class="file-stats">
<a href="#24e784ce6589bc97994395038371d07a9afaf7c9">
<span class="new-file">
+
.travis.settings.xml
</span>
</a>
</li>
<li class="file-stats">
<a href="#dea01dd89a3b602828e630677fde5d77c06441c8">
<span class="new-file">
+
.travis.yml
</span>
</a>
</li>
<li class="file-stats">
<a href="#2c5c5ed7d77485b627b5ba2e90b2f87baf64be55">
<span class="new-file">
+
BUILD.txt
</span>
</a>
</li>
<li class="file-stats">
<a href="#79b82ce9b64a924266619555502f890dd80c83b9">
<span class="new-file">
+
LICENSE.txt
</span>
</a>
</li>
<li class="file-stats">
<a href="#8ec9a00bfd09b3190ac6b22251dbb1aa95a0579d">
<span class="new-file">
+
README.md
</span>
</a>
</li>
<li class="file-stats">
<a href="#fda3484edf8db0684440157ce0b110d784d42704">
<span class="new-file">
+
README.txt
</span>
</a>
</li>
<li class="file-stats">
<a href="#174a5adaa4e92578d220fb3f1106b1c020442c25">
<span class="deleted-file">
−
debian/build.properties
</span>
</a>
</li>
<li class="file-stats">
<a href="#b347c465e5c70d3594bcc8806520592becaf5790">
<span class="deleted-file">
−
debian/build.xml
</span>
</a>
</li>
<li class="file-stats">
<a href="#9c96da0e9f91d7d8937b69b524702c106258f0d1">
debian/changelog
</a>
</li>
<li class="file-stats">
<a href="#58ef006ab62b83b4bec5d81fe5b32c3b4c2d1cc2">
debian/control
</a>
</li>
<li class="file-stats">
<a href="#adb7f75f79e3bb85eb62912a2904c5d24af878fb">
debian/copyright
</a>
</li>
<li class="file-stats">
<a href="#607114d5a384a98888d275243bc6ed47894fe124">
debian/libxstream-java.poms
</a>
</li>
<li class="file-stats">
<a href="#09661b26dadd0f6da66651a045417e1c81207c10">
debian/manifest
</a>
</li>
<li class="file-stats">
<a href="#26121dc92cd4cd9822d2e9e2b619b799bf9a51f4">
debian/maven.ignoreRules
</a>
</li>
<li class="file-stats">
<a href="#d006b76813d91cccc2a85e222d10982eb5d52728">
<span class="new-file">
+
debian/maven.properties
</span>
</a>
</li>
<li class="file-stats">
<a href="#58530b38acb0fa3a65612c676abaea46c4a3f2f3">
debian/maven.rules
</a>
</li>
<li class="file-stats">
<a href="#862e1c21e9df19f910102eae8c08952d0dea2bea">
<span class="deleted-file">
−
debian/orig-tar.sh
</span>
</a>
</li>
<li class="file-stats">
<a href="#972302bb0da82b107f5c436242f9505b4dc66c81">
<span class="new-file">
+
debian/patches/01-java7-compatibility.patch
</span>
</a>
</li>
<li class="file-stats">
<a href="#02405779aca4705c138ec066563d4a7ca1bcc31e">
<span class="deleted-file">
−
debian/patches/CVE-2016-3674.patch
</span>
</a>
</li>
<li class="file-stats">
<a href="#19f744cf73be4c8f6bcf5a691b7d183531202e91">
<span class="deleted-file">
−
debian/patches/CVE-2017-7957.patch
</span>
</a>
</li>
<li class="file-stats">
<a href="#f471d9cae850a4be7e90b2dad78f058e5461120d">
<span class="new-file">
+
debian/patches/CVE-2021-43859.patch
</span>
</a>
</li>
<li class="file-stats">
<a href="#8877459417d0e9cc9c5dc12b3976d1d98f7783c1">
<span class="new-file">
+
debian/patches/CVE-2022-41966.patch
</span>
</a>
</li>
<li class="file-stats">
<a href="#b87cfaae020f40cbbcecde9471093caa50235e61">
<span class="new-file">
+
debian/patches/SecurityVulnerabilityTest.patch
</span>
</a>
</li>
<li class="file-stats">
<a href="#eea9f02005539c52a9f2711fe287e0d5353a8950">
<span class="new-file">
+
debian/patches/debian-specific-whitelist-extension.patch
</span>
</a>
</li>
<li class="file-stats">
<a href="#1ff53baae8748d1a5d63335676adb309101bf999">
<span class="new-file">
+
debian/patches/enable-security-whitelist-by-default.patch
</span>
</a>
</li>
<li class="file-stats">
<a href="#69b8fe4e79414977855569a3c5603057919abd47">
<span class="new-file">
+
debian/patches/profile.patch
</span>
</a>
</li>
<li class="file-stats">
<a href="#bc34014ab4b9a49dd7a27bdd8d352912607c3a96">
debian/patches/series
</a>
</li>
<li class="file-stats">
<a href="#8756c63497c8dc39f7773438edf53b220c773f67">
debian/rules
</a>
</li>
</ul>
<h5 style="margin-top: 10px; margin-bottom: 10px; font-size: 0.875rem;">
The diff was not included because it is too large.
</h5>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
<a href="https://salsa.debian.org/java-team/libxstream-java/-/compare/081611e4bd0893194362e6e5ba667ebaddb61e85...eb8197f69e64af8e9a83118b2758a77bd5240d26">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://salsa.debian.org">salsa.debian.org</a>. <a href="https://salsa.debian.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://salsa.debian.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
</p>
</div>
</body>
</html>