CVE-2017-7957

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.

These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed.

This update includes the following new features:

to the repository metadata (fate#325676)

This update fixes the following issues:

apache-commons-lang3:

• Run fdupes on javadoc
• Specify java target and source level 1.6 to make package compatible with JDK >= 1.8

cobbler:

• Fixes case where distribution detection returns None (bsc#1130658)
• SUSE texmode fix (bsc#1109316)

drools:

• Update Drools to 7.17.0
• Release Notes: https://issues.jboss.org/secure/ReleaseNote.jspa
• Fixes for SLE 15 compatibility

guava:

• Updated from 13.0.1 to 27.0.1
• Changes between 13.0.1 and 23.0: https://github.com/google/guava/wiki/Release14 https://github.com/google/guava/wiki/Release15 https://github.com/google/guava/wiki/Release16 https://github.com/google/guava/wiki/Release17 https://github.com/google/guava/wiki/Release18 https://github.com/google/guava/wiki/Release19 https://github.com/google/guava/wiki/Release23
• Changes between 23.0 and 27.0.1: see https://github.com/google/guava/releases

jade4j:

• Conditional java/java-devel requires based on os version
• Update dependency version for commons-lang3 to 3.4
• Fix building javadoc

kie-api:

• Update KIE to 7.17.0
• Release notes: https://issues.jboss.org/secure/ReleaseNote.jspa

optaplanner:

• Update Optaplanner to 7.17.0

py26-compat-salt:

• Fix minion arguments assign via sysctl (bsc#1124290)

smdba:

• Make 'smdba space-overview' postgresql version agnostic (bsc#1129956)
• Fix version mismatch

spacecmd:

• Fix system_delete with SSM (bsc#1125744)

spacewalk-admin:

• Fix encoding bug in salt event processing (bsc#1129851)

spacewalk-backend:

• Fix linking of packages in reposync (bsc#1131677)
• Fix: handle non-standard filenames for comps.xml (bsc#1120242)
• Mgr-sign-metadata can optionally clear-sign metadata files

spacewalk-branding:

• Introduce a description label for the new 'minion-checkin' Taskomatic job (bsc#1122837)

spacewalk-certs-tools:

• Add support for Ubuntu to bootstrap script
• Clean up downloaded gpg keys after bootstrap (bsc#1126075)

spacewalk-java:

• Fix base channel selection for Ubuntu systems (bsc#1132579)
• Fix retrieval of build time for .deb repositories (bsc#1131721)
• Allow access to susemanager tools channels without res subscription (bsc#1127542)
• Add support for SLES 15 live patches in CVE audit
• Add a Taskomatic job to perform minion check-in regularly, drop use of Salt's Mine (bsc#1122837)
• Fix errata_details to return details correctly (bsc#1128228)
• Support ubuntu products and debian architectures in mgr-sync
• Adapt check for available repositories to debian style repositories
• Add support for custom username when bootstrapping with Salt-SSH
• Read and update running kernel release value at each startup of minion (bsc#1122381)
• Add error message on sync refresh when there are no scc credentials
• Fix apidoc issues
• Fix deleting server when minion_formulas.json is empty (bsc#1122230)
• Minion-action-cleanup Taskomatic task: do not clean actions younger than one hour
• Schedule full package refresh only once per action chain if needed (bsc#1126518)
• Check and schedule package refresh in response to events independently of what originates them (bsc#1126099)
• Add configuration option to limit the number of changelog entries added to the repository metadata (fate#325676)
• Generate InRelease file for Debian/Ubuntu repos when metadata signing is enabled

spacewalk-web:

• Show undetected subscription-matching message object as a string anyway (bsc#1125600)
• Fix action scheduler time picker prefill when the server is on 'UTC/GMT' timezone (bsc#1121195)
• Allow username input on bootstrap page when using Salt-SSH
• Add cache buster for static files (js/css) to fix caching issues after upgrading.

subscription-matcher:

• Update dependencies (Drools, Optaplanner, Guava, Xstream)
• Make the java and java-devel requirements variable
• Relax the requirement condition on apache-commons-lang3

susemanager: …

This update for xstream fixes the following issues:

• CVE-2017-7957: XStream could cause a Denial of Service when unmarshalling void. (bsc#1070731)

This update for xstream fixes the following issues:

• CVE-2017-7957: XStream could cause a Denial of Service when unmarshalling void. (bsc#1070731)

This update includes the following new features:

to the repository metadata (fate#325676)

This update fixes the following issues:

apache-commons-lang3:

• Run fdupes on javadoc
• Specify java target and source level 1.6 to make package compatible with JDK >= 1.8

cobbler:

• Fixes case where distribution detection returns None (bsc#1130658)
• SUSE texmode fix (bsc#1109316)

drools:

• Update Drools to 7.17.0
• Release Notes: https://issues.jboss.org/secure/ReleaseNote.jspa
• Fixes for SLE 15 compatibility

guava:

• Updated from 13.0.1 to 27.0.1
• Changes between 13.0.1 and 23.0: https://github.com/google/guava/wiki/Release14 https://github.com/google/guava/wiki/Release15 https://github.com/google/guava/wiki/Release16 https://github.com/google/guava/wiki/Release17 https://github.com/google/guava/wiki/Release18 https://github.com/google/guava/wiki/Release19 https://github.com/google/guava/wiki/Release23
• Changes between 23.0 and 27.0.1: see https://github.com/google/guava/releases

jade4j:

• Conditional java/java-devel requires based on os version
• Update dependency version for commons-lang3 to 3.4
• Fix building javadoc

kie-api:

• Update KIE to 7.17.0
• Release notes: https://issues.jboss.org/secure/ReleaseNote.jspa

optaplanner:

• Update Optaplanner to 7.17.0

py26-compat-salt:

• Fix minion arguments assign via sysctl (bsc#1124290)

smdba:

• Make 'smdba space-overview' postgresql version agnostic (bsc#1129956)
• Fix version mismatch

spacecmd:

• Fix system_delete with SSM (bsc#1125744)

spacewalk-admin:

• Fix encoding bug in salt event processing (bsc#1129851)

spacewalk-backend:

• Fix linking of packages in reposync (bsc#1131677)
• Fix: handle non-standard filenames for comps.xml (bsc#1120242)
• Mgr-sign-metadata can optionally clear-sign metadata files

spacewalk-branding:

• Introduce a description label for the new 'minion-checkin' Taskomatic job (bsc#1122837)

spacewalk-certs-tools:

• Add support for Ubuntu to bootstrap script
• Clean up downloaded gpg keys after bootstrap (bsc#1126075)

spacewalk-java:

• Fix base channel selection for Ubuntu systems (bsc#1132579)
• Fix retrieval of build time for .deb repositories (bsc#1131721)
• Allow access to susemanager tools channels without res subscription (bsc#1127542)
• Add support for SLES 15 live patches in CVE audit
• Add a Taskomatic job to perform minion check-in regularly, drop use of Salt's Mine (bsc#1122837)
• Fix errata_details to return details correctly (bsc#1128228)
• Support ubuntu products and debian architectures in mgr-sync
• Adapt check for available repositories to debian style repositories
• Add support for custom username when bootstrapping with Salt-SSH
• Read and update running kernel release value at each startup of minion (bsc#1122381)
• Add error message on sync refresh when there are no scc credentials
• Fix apidoc issues
• Fix deleting server when minion_formulas.json is empty (bsc#1122230)
• Minion-action-cleanup Taskomatic task: do not clean actions younger than one hour
• Schedule full package refresh only once per action chain if needed (bsc#1126518)
• Check and schedule package refresh in response to events independently of what originates them (bsc#1126099)
• Add configuration option to limit the number of changelog entries added to the repository metadata (fate#325676)
• Generate InRelease file for Debian/Ubuntu repos when metadata signing is enabled

spacewalk-web:

• Show undetected subscription-matching message object as a string anyway (bsc#1125600)
• Fix action scheduler time picker prefill when the server is on 'UTC/GMT' timezone (bsc#1121195)
• Allow username input on bootstrap page when using Salt-SSH
• Add cache buster for static files (js/css) to fix caching issues after upgrading.

subscription-matcher:

• Update dependencies (Drools, Optaplanner, Guava, Xstream)
• Make the java and java-devel requirements variable
• Relax the requirement condition on apache-commons-lang3

susemanager: …