CVE-2022-4065

TestNG is a testing framework inspired from JUnit and NUnit but introducing some new functionality that make it more powerful and easier to use, such as: * Annotations. * Run your tests in arbitrarily big thread pools with various policies available (all methods in their own thread, one thread per test class, etc...). * Test that your code is multithread safe. * Flexible test configuration. * Support for data-driven testing (with @DataProvider). * Support for parameters. * Powerful execution model (no more TestSuite). * Supported by a variety of tools and plug-ins (Eclipse, IDEA, Maven, etc...). * Embeds BeanShell for further flexibility. * Default JDK functions for runtime and logging (no dependencies). * Dependent methods for application server testing.

Security Fix(es):

A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027.(CVE-2022-4065)

A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027.

Path traversal in zip files (CVE-2022-4065)

These are all security issues fixed in the testng-7.4.0-3.1 package on the GA media of openSUSE Tumbleweed.

This update for testng fixes the following issues:

• CVE-2022-4065: Fixed a path traversal in zip files (bsc#1205628).

This update for mockito, snakeyaml, testng fixes the following issues:

mockito was updated to version 5.11.0:

• Added bundle manifest to the mockito-core artifact

• Mockito 5 is making core changes to ensure compatibility with future JDK versions.

• Switch the Default MockMaker to mockito-inline (not applicable to mockito-android)

  • Mockito 2.7.6 introduced the mockito-inline mockmaker based on the 'inline bytecode' principle, offering compatibility advantages over the subclass mockmaker
  • This change avoids JDK restrictions, such as violating module boundaries and leaking subclass creation

• Legitimate use cases for the subclass mockmaker:

  • Scenarios where the inline mockmaker does not function, such as on Graal VM's native image
  • If avoiding mocking final classes, the subclass mockmaker remains a viable option, although issues may arise on JDK 17+
  • Mockito aims to support both mockmakers, allowing users to choose based on their requirements.

• Update the Minimum Supported Java Version to 11

  • Mockito 5 raised the minimum supported Java version to 11
  • Community member @reta contributed to this change.
  • Users still on JDK 8 can continue using Mockito 4, with minimal API differences between versions

• New type() Method on ArgumentMatcher

  • The ArgumentMatcher interface now includes a new type() method to support varargs methods, addressing previous limitations
  • Users can now differentiate between matching calls with any exact number of arguments or match any number of arguments
  • Mockito 5 provides a default implementation of the new method, ensuring backward compatibility.
  • No obligation for users to implement the new method; Mockito 5 considers Void.type by default for varargs handling
  • ArgumentCaptor is now fully type-aware, enabling capturing specific subclasses on a generic method.

• byte-buddy does not bundle asm, but uses objectweb-asm as external library

snake-yaml was updated to version 2.2:

• Changes of version 2.2:

  • Define default scalar style as PLAIN (for polyglot Maven)
  • Add missing 'exports org.yaml.snakeyaml.inspector' to module-info.java

• Changes of version 2.1:

  • Heavy Allocation in Emitter.analyzeScalar(String) due to Regex Overhead
  • Use identity in toString() for sequences to avoid OutOfMemoryError
  • NumberFormatException from SnakeYAML due to int overflow for corrupt YAML version
  • Document size limit should be applied to single document notthe whole input stream
  • Detect invalid Unicode code point (thanks to Tatu Saloranta)
  • Remove Trusted*Inspector classes from main sources tree

• Changes of version 2.0:

  • Rollback to Java 7 target
  • Add module-info.java
  • Migrate to Java 8
  • Remove many deprecated constructors
  • Remove long deprecated methods in FlowStyle
  • Do not allow global tags by default
  • Yaml.LoadAs() signature to support Class<? super T> type instead of Class<T>
  • CustomClassLoaderConstructor takes LoaderOptions
  • Check input parameters for non-null values

testng was updated to version 7.10.1:

• Security issues fixed:

  • CVE-2022-4065: Fixed Zip Slip Vulnerability (bsc#1205628)

• Changes of version 7.10.1:

  • Fixed maven build with junit5

• Changes of version 7.10.0:

  • Minor discrepancy fixes
  • Deleting TestNG eclipse plugin specific classes
  • Remove deprecated JUnit related support in TestNG
  • Handle exceptions in emailable Reporter
  • Added wrapperbot and update workflow order
  • Support ITestNGFactory customisation
  • Streamlined data provider listener invocation
  • Streamlined Guice Module creation in concurrency.
  • Copy test result attributes when unexpected failures
  • chore: use explicit dependency versions instead of refreshVersions
  • Removed Ant
  • Support ordering of listeners
  • Added errorprone
  • Allow custom thread pool executors to be wired in.
  • Allow data providers to be non cacheable
  • Use Locks instead of synchronised keyword
  • Document…