CVE-2022-25647

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

The package com.google.code.gson:gson before 2.8.9 is vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to denial of service attacks.

Gson is a Java library that can be used to convert a Java object into its JSON representation. It can also be used to convert a JSON string into an equivalent Java object. Gson can work with arbitrary Java objects including pre-existing objects that you do not have source-code of. There are a few open-source projects that can convert Java objects to JSON. However, most of them require that you place Java annotations in your classes; something that you can not do if you do not have access to the source-code. Most also do not fully support the use of Java Generics. Gson considers both of these as very important design goals.

Security Fix(es):

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.(CVE-2022-25647)

Red Hat Lightwell has released com.google.code.gson:gson 2.8.6.rhlw-00002 with a backported security fix.

CVE-2022-25647: Deserialization of Untrusted Data

This patched artifact is a drop-in replacement for com.google.code.gson:gson 2.8.6 from Maven Central.

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

TuxCare rebuilt 2 com.google.code.gson packages to address 2 CVEs. Fixed in 2.8.5-tuxcare.1.

TuxCare rebuilt com.google.code.gson:gson to address 1 CVE. Fixed in 2.4-tuxcare.1.

TuxCare rebuilt com.google.code.gson:gson to address 1 CVE. Fixed in 2.2.4-tuxcare.1.

TuxCare rebuilt com.google.code.gson:gson to address 2 CVEs. Fixed in 2.2.2-tuxcare.1.

TuxCare rebuilt com.google.code.gson:gson to address 1 CVE. Fixed in 2.7-tuxcare.1.

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks. (CVE-2022-25647)

These are all security issues fixed in the google-gson-2.8.9-3.1 package on the GA media of openSUSE Tumbleweed.

This update for google-gson fixes the following issues:

• CVE-2022-25647: Fixed deserialization of untrusted data (bsc#1199064).

This update for google-gson fixes the following issues:

Fixed security issue:

• CVE-2022-25647: Deserialization of Untrusted Data (bsc#1199064)

Other non security fixes:

• Build with Java >= 9 in order to produce a modular jar by compiling the module-info.java sources with all other classes built with release 8 and still compatible with Java 8
• Upgrade to version 2.8.9 (jsc#SLE-24261)
  • Make OSGi bundle's dependency on sun.misc optional.
  • Deprecate Gson.excluder() exposing internal Excluder class.
  • Prevent Java deserialization of internal classes.
  • Improve number strategy implementation.
  • Fix LongSerializationPolicy null handling being inconsistent with Gson.
  • Support arbitrary Number implementation for Object and Number deserialization.
  • Bump proguard-maven-plugin from 2.4.0 to 2.5.1.
  • Don't exclude static local classes.
  • Fix RuntimeTypeAdapterFactory depending on internal Streams class.
  • Improve Maven build.
  • Make dependency on java.sql optional.
  • Fixed issue with recursive types.
  • Better behavior with Java 9+ and Unsafe if there is a security manager.
  • EnumTypeAdapter now works better when ProGuard has obfuscated enum fields.
  • make import of sun.misc optional since not all versions of jdk export it

It was discovered that Gson incorrectly handled deserialization of untrusted input data. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.