[IT-SecNots] [SECURITY] [DSA 5227-1] libgoogle-gson-java security update

[Markus Koschany <apo AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-5227-1                   security AT debian.org
https://www.debian.org/security/                          Markus Koschany
September 07, 2022                    https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libgoogle-gson-java
CVE ID         : CVE-2022-25647
Debian Bug     : 1010670

It was discovered that Gson, a Java library that can be used to convert Java
Objects into their JSON representations and vice versa, was vulnerable to a 
de-
serialization flaw. An application would de-serialize untrusted data without
sufficiently verifying that the resulting data will be valid, letting the
attacker to control the state or the flow of the execution. This can lead to a
denial of service or even the execution of arbitrary code.

For the stable distribution (bullseye), this problem has been fixed in
version 2.8.6-1+deb11u1.

We recommend that you upgrade your libgoogle-gson-java packages.

For the detailed security status of libgoogle-gson-java please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libgoogle-gson-java

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmMYb6lfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeSXGhAAncI4woNYtCF4ycC/ZMRXdvTSxv3qhChO4YeLni5j0ViuAKOs1hWMlos3
q9TZCw6kr2Vl0lAYZf50SIsryHhX5oSSlr8gxRANvN/SEq9lq9qNe/xhVQIi0VD3
tkGyia+/i1rkiR9ZZBna7bUOyoMWoNK2EJ8evdZLh8BV8sK+lIwPuY1vyi0OA/0J
OVXoaiZ47FqmOD0bcYZJtrE5L1W5XnwvA5LClIbNJvHBqzByW5DxzeWnKNhSg03N
LHBQO69BZR6j4jK4R4/uJR3ESXEk9Btz6KT1guwFhuYyQThN6TuMHp2tANmT/b2O
Mh0wGE5dWLBt6A/6n4jRE5wh8OY9QmQkapFVwVrO2c4xqq5g5tuv8AIn3SJ+AYzQ
KksFS8lVX0d43Tu7cwZ231YHeZM5Uq7yvmxvOO76LB5wlWRepqHRwC1F3jgca5JX
LISqW0KTCkxiEC9Y2RyArc3vL3Ltkr74ePgIhFktHqFQM83pB13VIO6+8NSSda9+
XsxZgDQ4mLVzyVSK2dYIf2UXWRgk22V21q+DBPeGtQnoGsnfrbTWrEZXfsk6lykV
UenG+G2s/BBJN0HsKHCmspc+E+qViq+Yz2Hhk/7Vcn5H+6W+7foGSu5ZHKR9eYmW
sHj29iepMRIxF6wgLwjOArt4CgIlP/KEIk1lecK3Bell3aSUVCQ=
=Hr3j
-----END PGP SIGNATURE-----