Summary
This update for apache-commons-io fixes the following issues:
apache-commons-io was updated from version 2.15.1 to 2.18.0:
- Key changes across versions:
* Cleaner code and updated dependencies
* Improved security when handling serialized data with the new safe deserialization feature
* New features for advanced file and stream operations
* Various bugs were fixed to improve reliability with fewer crashes and unexpected errors
* For the full list of changes please consult the packaged RELEASE-NOTES.txt
- Already fixed in previous version:
* CVE-2024-47554: Untrusted input to XmlStreamReader can lead to uncontrolled resource consumption (bsc#1231298)
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| SUSE · Enterprise Storage 7.1 | apache-commons-io | 2.18.0-150200.3.15.1 |
| openSUSE · Leap 15.6 | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLE HPC 15 SP3 Linux Enterprise High Performance Computing 15 SP3-LTSS | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLE HPC 15 SP4 Linux Enterprise High Performance Computing 15 SP4-ESPOS | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLE HPC 15 SP4 Linux Enterprise High Performance Computing 15 SP4-LTSS | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLE HPC 15 SP5 Linux Enterprise High Performance Computing 15 SP5-ESPOS | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLE HPC 15 SP5 Linux Enterprise High Performance Computing 15 SP5-LTSS | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLES 15 SP6 Linux Enterprise Module for Basesystem 15 SP6 | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLES 15 SP3 Linux Enterprise Server 15 SP3-LTSS | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLES 15 SP4 Linux Enterprise Server 15 SP4-LTSS | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLES 15 SP5 Linux Enterprise Server 15 SP5-LTSS | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLES for SAP 15 SP3 Linux Enterprise Server for SAP Applications 15 SP3 | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLES for SAP 15 SP4 Linux Enterprise Server for SAP Applications 15 SP4 | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · SLES for SAP 15 SP5 Linux Enterprise Server for SAP Applications 15 SP5 | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · Manager Proxy 4.3 | apache-commons-io | 2.18.0-150200.3.15.1 |
| SUSE · Manager Server 4.3 | apache-commons-io | 2.18.0-150200.3.15.1 |
Vulnerabilities 1
-
Medium 4.3
Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …