[
https://issues.apache.org/jira/browse/MPH-174?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17371730#comment-17371730
]
Hudson commented on MPH-174:
----------------------------
Build succeeded in Jenkins: Maven » Maven TLP » maven-help-plugin » master #38
See
https://ci-builds.apache.org/job/Maven/job/maven-box/job/maven-help-plugin/job/master/38/
> Upgrade XStream to 1.4.17
> -------------------------
>
> Key: MPH-174
> URL: https://issues.apache.org/jira/browse/MPH-174
> Project: Maven Help Plugin
> Issue Type: Dependency upgrade
> Reporter: Sylwester Lachiewicz
> Assignee: Sylwester Lachiewicz
> Priority: Major
> Fix For: 3.3.0
>
>
> h1. 1.4.17
> Released May 13, 2021.
> This maintenance release addresses the security vulnerability
> [CVE-2021-29505|http://x-stream.github.io/CVE-2021-29505.html], when
> unmarshalling with XStream instances using an uninitialized security
> framework.
> h2. Stream compatibility
> * The following types are now blacklisted by default and the deserialization
> of XML containing one of the two types will fail. You will have to enable
> these types by explicit configuration, if you need them:
> ** any type in the java.rmi.* and sun.rmi.* package hierarchies
> ** the individual type com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl
> h1. 1.4.16
> Released March 13, 2021.
> This maintenance release switches XStream's default parser and addresses
> following security vulnerabilities, when unmarshalling with an XStream
> instances using an uninitialized security framework.
> * [CVE-2021-21341|http://x-stream.github.io/CVE-2021-21341.html]
> * [CVE-2021-21342|http://x-stream.github.io/CVE-2021-21342.html]
> * [CVE-2021-21343|http://x-stream.github.io/CVE-2021-21343.html]
> * [CVE-2021-21344|http://x-stream.github.io/CVE-2021-21344.html]
> * [CVE-2021-21345|http://x-stream.github.io/CVE-2021-21345.html]
> * [CVE-2021-21346|http://x-stream.github.io/CVE-2021-21346.html]
> * [CVE-2021-21347|http://x-stream.github.io/CVE-2021-21347.html]
> * [CVE-2021-21348|http://x-stream.github.io/CVE-2021-21348.html]
> * [CVE-2021-21349|http://x-stream.github.io/CVE-2021-21349.html]
> * [CVE-2021-21350|http://x-stream.github.io/CVE-2021-21350.html]
> * [CVE-2021-21351|http://x-stream.github.io/CVE-2021-21351.html]
> h2. Major changes
> * Switch from Xpp3 as default parser to MXParser, a fork of Xpp3.
> h2. Minor changes
> * [#238|https://github.com/x-stream/xstream/issues/238]: Fix possibility to
> process references on enum types at deserialization.
> * [#237|https://github.com/x-stream/xstream/issues/237]: Fix optimization in
> XmlFriendlyNameCoder.
> h2. Stream compatibility
> * The following types are now blacklisted by default and the deserialization
> of XML containing one of the two types will fail. You will have to enable
> these types by explicit configuration, if you need them:
> ** the type hierarchies for java.io.InputStream, java.nio.channels.Channel,
> javax.activation.DataSource and javax.sql.rowsel.BaseRowSet
> ** the individual types com.sun.corba.se.impl.activation.ServerTableEntry,
> com.sun.tools.javac.processing.JavacProcessingEnvironment$NameProcessIterator,
> sun.awt.datatransfer.DataTransferer$IndexOrderComparator, and
> sun.swing.SwingLazyValue
> ** the individual types com.sun.corba.se.impl.activation.ServerTableEntry,
> com.sun.tools.javac.processing.JavacProcessingEnvironment$NameProcessIterator,
> sun.awt.datatransfer.DataTransferer$IndexOrderComparator, and
> sun.swing.SwingLazyValue
> ** the internal type Accessor$GetterSetterReflection of JAXB, the internal
> types MethodGetter$PrivilegedGetter and ServiceFinder$ServiceNameIterator of
> JAX-WS
> ** all inner classes of javafx.collections.ObservableList
> ** an internal ClassLoader used in a private copy of BCEL within the Java
> runtime
> h2. Dependencies
> The default parser of XStream has changed from the Xpp3Parser in artifact
> xpp3:xpp3_min to MXParser, a fork of Xpp3 in the artifact
> io.github.x-stream:mxparser. The Xpp3 is unmaintained for a long time, bugs
> have been fixed reported more than a decade ago, improvements by other forks
> have been incorporated and some endless loops have been fixed, that could
> have been utilized as DoS attack.
> XStream has therefore new default dependencies. If you have used XStream with
> the default driver (i.e. Xpp3), you can still exchange the XStream library
> for a drop-in replacement, but you will also have to remove the Xpp3 and add
> the MXParser library instead.
> For build time you will have to add the Xpp3 library to your dependencies, if
> you made explicitly use of the Xpp3 driver. If you did explicitly use a
> different driver than Xpp3 and had therefore excluded the Xpp3 dependency,
> you might have to exclude now the new MXParser dependency instead to minimize
> your dependency list.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
