SUSE Package Hub - SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-4527

Update Info

SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-4527

Security update for maven, maven-resolver, sbt, xmvn

Type: security

Severity: moderate

Issued: 2023-11-22

Description:

This update for maven, maven-resolver, sbt, xmvn fixes the following issues:

- CVE-2023-46122: Fixed an arbitrary file write when extracting a
  crafted zip file with sbt (bsc#1216529).
- Upgraded maven to version 3.9.4
- Upgraded maven-resolver to version 1.9.15.

References

CVE: CVE-2023-46122
Bugzilla: 1216529 VUL-0: CVE-2023-46122: sbt: Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's mai ...
Bugzilla: 1162112 xmvn produces unreproducible output

Packages

sbt-0.13.18-150200.4.16.1

sbt-bootstrap-0.13.18-150200.4.16.1