SUSE-SU-2026:4677-1

Описание

This update for Java fixes the following issues:

This update introduces new libraries and refines existing Java tools to improve security, compatibility, stability, and formatting.

ant (Updated to version 1.10.18):

• Security issues fixed:

  • CVE-2021-36374: Fixed excessive memory allocation when reading specially crafted ZIP archives or derived formats (bsc#1188469)
  • CVE-2025-7962: Fixed improper neutralization of line breaks to prevent SMTP injection (bsc#1246873)
  • CVE-2026-78254: Fixed path traversal in FTP and SCP tasks that could allow arbitrary file writes (bsc#1280015)

• Other changes and bugs fixed:

  • Breaking changes:

    • FTPS tasks now use encrypted data channels by default.
    • FTP and SCP tasks now prevent files or directories from being written outside the target directory by default.

  • Other changes:

    • Added package ant-junit5 that allows tests to be launched and run using the JUnit 5 framework.
    • Improved support for reproducible builds by standardizing timestamps, file modification times, and timezone handling.
    • Upgraded the jakarta.mail dependency to version 2.0.2.
    • Added an option to the 'record' task to create log files relative to the project directory.

  • Bugs fixed:

    • Fixed compatibility and startup issues when running on newer Java versions.
    • Fixed network handling issues in FTP and SCP tasks, including proper support for IPv6 addresses.
    • Improved security in email tasks by verifying TLS server certificates and enforcing STARTTLS encryption.
    • Improved report generation performance in JUnit launcher tasks.
    • Fixed regressions and edge cases in resource mapping, path conversion, and command execution.

json-simple (Updated to version 2.3.1):

• Updated to a newer version that makes reading and writing structured web data (JSON) safer and more reliable.
• Added a 'pretty-printing' feature to format web data so it is easier to read.
• Made reading and writing data safer when multiple tasks are running simultaneously.
• Made looking up data more flexible, allowing the tool to automatically handle different format types (like numbers and text).

junit5 (Updated to version 5.14.4):

• Fixed an issue where tests could conflict or run incorrectly when executed at the same time.
• Corrected test behavior on newer versions of Java so they run reliably.
• Improved test reports so that test names are clearer, unique, and easier to distinguish from one another.
• Added features to customize how test names are generated and better capture testing outputs.

maven-doxia, maven-doxia-sitetools (Updated to version 2.1.0):

• Added support for displaying the last modification date and author on generated web pages.
• Added support for displaying interactive diagrams (such as flowcharts or charts) directly on web pages.
• Improved formatting and layout for modern documents, including better tables, lists, and links.

maven-surefire, maven-surefire-plugins (Updated to version 3.5.6):

• Fixed a bug that caused software testing tasks to fail abruptly with an unexpected error [bsc#1273185].
• Added timestamps to testing reports so you can see exactly when tests ran.
• Made running multiple tests at the same time much more reliable, preventing mixed-up report results.
• Added the ability to immediately stop testing once a failure is detected (saving time).

objectweb-asm (Updated to version 9.10.1):

• Added support for newer Java versions, including bytecode support up to Java 27.
• Prevented out-of-memory errors when processing invalid or corrupted class files.
• Improved bytecode analysis and verification to correctly handle valid Java code and prevent unexpected analysis errors
• Improved compliance with FIPS 140-3 security standards during class serialization.
• Corrected package import ranges to prevent dependency conflicts in OSGi environments.
• Fixed unexpected crashes and errors in code generation and inspection utilities.

plexus-archiver (Updated to version 4.14.0):

• Added support for following symbolic links when collecting files for archives.
• Reduced memory usage when creating ZIP archives to prevent out-of-memory errors during large builds.
• Fixed an issue where reading file attributes on Windows systems could cause unexpected errors.
• Improved ZIP archive handling, fixing checksum calculation errors, negative timestamp issues, and file permissions.
• Replaced compression components with Apache Commons Compress to eliminate vulnerable dependencies.
• Added Java Module System (JPMS) support for compatibility with modern Java versions.
• Updated dependencies, including commons-io to 2.22.0, xz to 1.12, and zstd-jni to 1.5.7-15.

plexus-build-api (Updated to version 1.2.0):

• Updated dependencies for compatibility with modern build and injection tools.

plexus-cipher (Updated to version 2.1.0):

• Updated dependencies for compatibility with modern build and injection tools.

plexus-classworlds (Updated to version 2.12.1):

• Fixed file pattern matching (glob matching) when loading classes and resources.
• Restored backward compatibility with legacy Maven 2 configurations.
• Added support for registering filtered class realms.
• Implemented clean resource shutdown support (Closeable) for class loaders.
• Added support for the PPC64LE architecture.
• Added Java Module System (JPMS) support for compatibility with modern Java versions.
• Updated dependencies, including jakarta.xml.bind-api, log4j-api, and ant.

plexus-compiler (Updated to version 2.17.1):

• Fixed a security issue (Zip Slip) that could allow arbitrary file overwrite during archive extraction.
• Fixed an unexpected crash (ConcurrentModificationException) when processing compiler arguments concurrently.
• Fixed compiler diagnostics and warning reporting to ensure multi-line messages and warning categories are properly displayed.
• Fixed Java version detection when custom options or newer Java versions are present.
• Fixed an issue where the Eclipse Java Compiler (ECJ) failed to detect annotation processors configured in the processor path.
• Added support for quoting compiler argument files to safely handle paths containing spaces.
• Fixed cross-drive file path handling on Windows systems.
• Added Java Module System (JPMS) support for compatibility with modern Java versions.
• Updated dependencies, including Google Guava to 33.7.1 and Eclipse Java Compiler (ECJ) to 3.46.100.

plexus-containers (Updated to version 2.2.0):

• Added the plexus-metadata-generator Ant task and command-line interface to generate component metadata.
• Added the plexus-metadata-generator-ant package capability.

plexus-i18n (Updated to version 1.2.0):

• Corrected language translation lookup to prevent unintentionally falling back to the system default locale.
• Added Java Module System (JPMS) support for compatibility with modern Java versions.
• Updated internal dependencies.

plexus-interactivity (Updated to version 1.6.0):

• Upgraded the terminal reader dependency to JLine 3 for improved console and terminal interaction.
• Added Java Module System (JPMS) support for compatibility with modern Java versions.
• Updated dependencies, including Sisu Inject to 1.1.0 and Guice to 5.1.0.

plexus-interpolation (Updated to version 1.30.0):

• Fixed caching issues in string and regular expression interpolators to significantly improve evaluation performance and consistency.
• Added support for feedback value sources and delimiter tracking.
• Added Java Module System (JPMS) support for compatibility with modern Java versions.
• Updated internal dependencies.

plexus-io (Updated to version 3.8.0):

• Improved performance by caching Unix user and group lookups.
• Fixed file handling to properly follow symbolic links when configured.
• Fixed an issue where temporary files were left unclosed, preventing file-not-found errors.
• Improved resilience when querying file attributes on network file systems.
• Added support for tracking hard-link identities for unchanged files.
• Added Java Module System (JPMS) support for compatibility with modern Java versions.
• Updated dependencies, including commons-io to 2.22.0, plexus-utils to 3.6.2, and Sisu Inject to 1.1.0.

plexus-languages (Updated to version 1.6.0):

• Replaced the source code parser with JavaParser for improved language support and modern Java compatibility.
• Added support for newer Java versions, including JDK 23 and JDK 24 bytecode.
• Improved the speed of detecting Java class file versions.
• Added validation to detect and report duplicate modules on the module path.
• Updated dependencies, including ObjectWeb ASM to 9.10.1.

plexus-sec-dispatcher (Updated to version 2.0):

• Modernized component injection by using standard javax.inject annotations.
• Updated dependencies for compatibility with modern Sisu tools.

plexus-utils (Updated to version 4.1.0):

• Breaking change: File scanning no longer excludes '.gitignore' and '.cvsignore' files by default.
• Fixed a security issue (Zip Slip) that could allow arbitrary file overwrite during archive extraction.
• Added Java Module System (JPMS) support for compatibility with modern Java versions.
• Updated internal dependencies.

plexus-velocity (Updated to version 2.4.0):

• Reduced runtime dependency requirements by eliminating unnecessary injection components.
• Added Java Module System (JPMS) support for compatibility with modern Java versions.
• Updated dependencies to secure releases, including Apache Velocity Engine to 2.4.1 and Commons Lang to 3.20.0.

plexus-xml (Updated to version 3.1.0):

• Fixed XML parsing issues when reading documents in UTF-8 (without BOM) and ISO-8859-1 encodings.
• Added Java Module System (JPMS) support for compatibility with modern Java versions.
• Updated internal dependencies, including plexus-utils to 4.0.2.

New package dependencies distributed:

• apache-commons-digester3: XML-to-Java object mapping library; required at runtime by velocity-tools.
• javaparser: Java source code parser and abstract syntax tree library; required at runtime by plexus-languages.
• antlr: Parser generator for reading, processing, and translating structured text; required at runtime by ant (ant-antlr).
• jakarta-mail: Implementation of the Jakarta Mail API for email handling (addresses CVE-2025-7962); required at runtime by ant (ant-jakartamail).
• jakarta-activation: Framework for handling MIME data types and extensible data content; required at runtime by jakarta-mail and ant (ant-jakartamail).
• univocity-parsers: Fast CSV, TSV, and fixed-width tabular text parser collection; required at runtime by ant (ant-junit5) and junit5.
• opentest4j: Common exception and test assertion abstraction for JVM testing frameworks; required at runtime by ant (ant-junit5) and junit5.
• picocli: Annotation-based command-line interface parser; required at runtime by junit5.
• assertj-core: Fluent assertion library for Java testing; required at runtime by junit5.
• plexus-build-api0: Compatibility API layer for Plexus build tooling; required at runtime by plexus-build-api.
• qdox: High-speed parser for extracting class, interface, and Javadoc metadata; required at runtime by plexus-containers (plexus-component-metadata).
• bsf: Bean Scripting Framework for running scripting languages from Java; required at runtime by ant (ant-apache-bsf).
• jdepend: Metric generator analyzing Java package design and dependencies; required at runtime by ant (ant-jdepend).
• javassist: Java bytecode manipulation and analysis toolkit; required at runtime by javaparser.
• ant-contrib: Additional tasks, condition handlers, and control-flow logic for Apache Ant; optional runtime companion for ant.
• byte-buddy: Runtime code generation and bytecode manipulation library; required at runtime by junit5 and ant-junit5.
• velocity-tools: Reusable tools and view support helpers for the Apache Velocity template engine; standalone runtime library for template-driven web applications.
• zstd-jni: JNI bindings providing fast and high-ratio lossless compression via Zstandard; required at runtime by plexus-archiver.