SUSE-SU-2023:3187-1 Security update for javapackages-tools, javassist, mysql-connector-java, protobuf, python-python-gflags
Not scored
Published
Check this codebase for SUSE-SU-2023:3187-1 and fix it if it is affected.
What it is: SUSE-SU-2023:3187-1 is a vulnerability in javapackages-tools, published on 3 Aug 2023.
Exploitation: There is no known exploitation of SUSE-SU-2023:3187-1 in the wild and no public exploit code.
Affected product: javapackages-tools. No package-level version data is available, so check the vendor advisory linked from the reference page.
Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.
Reference: https://insights.sbomify.com/SUSE-SU-2023-3187-1/ (Markdown: https://insights.sbomify.com/SUSE-SU-2023-3187-1/index.md)
Security update for Java libraries including mysql-connector-java, addressing various bugs and dependency issues.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- Available
What is SUSE-SU-2023:3187-1?
SUSE-SU-2023:3187-1 is a vulnerability in javapackages-tools, published on 3 Aug 2023.
Official description
This update for javapackages-tools, javassist, mysql-connector-java, protobuf, python-python-gflags contains the following fixes:
Changes in mysql-connector-java:
- Restrict license to GPL-2.0-only
- Fix README adjustments
- Depend on log4j rather than log4j-mini and adjust log4j dependencies to account for the lack of log4j12 Provides in some code streams.
- Add missing Group tag
- Update to 8.0.25 (SOC-11543)
Changes in 8.0.25
- No functional changes: version alignment with MySQL Server 8.0.25. Changes in 8.0.24
- Bug#102188 (32526663), AccessControlException with AuthenticationLdapSaslClientPlugin.
- Bug#22508715, SETSESSIONMAXROWS() CALL ON CLOSED CONNECTION RESULTS IN NPE.
- Bug#102131 (32338451), UPDATABLERESULTSET NPE WHEN USING DERIVED QUERIES OR VIEWS.
- Bug#101596 (32151143), GET THE 'HOST' PROPERTY ERROR AFTER CALLING TRANSFORMPROPERTIES() METHOD.
- Bug#20391832, SETOBJECT() FOR TYPES.TIME RESULTS IN EXCEPTION WHEN VALUE HAS FRACTIONAL PART.
- Bug#97730 (31699993), xdev api: ConcurrentModificationException at Session.close.
- Bug#99708 (31510398), mysql-connector-java 8.0.20 ASSERTION FAILED: Unknown message type: 57 s.close.
- Bug#32122553, EXTRA BYTE IN COM_STMT_EXECUTE.
- Bug#101558 (32141210), NULLPOINTEREXCEPTION WHEN EXECUTING INVALID QUERY WITH USEUSAGEADVISOR ENABLED.
- Bug#102076 (32329915), CONTRIBUTION: MYSQL JDBC DRIVER RESULTSET.GETLONG() THROWS NUMBEROUTOFRANGE.
- Bug#31747910, BUG 30474158 FIX IMPROVES JDBC COMPLIANCE BUT CHANGES DEFAULT RESULTSETTYPE HANDLING.
- Bug#102321 (32405590), CALLING RESULTSETMETADATA.GETCOLUMNCLASSNAME RETURNS WRONG VALUE FOR DATETIME.
- WL#14453, Pluggable authentication: new default behavior & user-less authentications.
- WL#14392, Improve timeout error messages [classic].
- WL#14202, XProtocol: Support connection close notification. Changes in 8.0.23
- Bug#21789378, FORCED TO SET SERVER TIMEZONE IN CONNECT STRING.
- Bug#95644 (30573281), JDBC GETDATE/GETTIME/GETTIMESTAMP INTERFACE BEHAVIOR CHANGE AFTER UPGRADE 8.0.
- Bug#94457 (29402209), CONNECTOR/J RESULTSET.GETOBJECT( …, OFFSETDATETIME.CLASS ) THROWS.
- Bug#76775 (20959249), FRACTIONAL SECONDS IN TIME VALUES ARE NOT AVAILABLE VIA JDBC.
- Bug#99013 (31074051), AN EXTRA HOUR GETS ADDED TO THE TIMESTAMP WHEN SUBTRACTING INTERVAL 'N' DAYS.
- Bug#98695 (30962953), EXECUTION OF 'LOAD DATA LOCAL INFILE' COMMAND THROUGH JDBC FOR DATETIME COLUMN.
- Bug#101413 (32099505), JAVA.TIME.LOCALDATETIME CANNOT BE CAST TO JAVA.SQL.TIMESTAMP.
- Bug#101242 (32046007), CANNOT USE BYTEARRAYINPUTSTREAM AS ARGUMENTS IN PREPARED STATEMENTS AN MORE.
- WL#14274, Support for authentication_ldap_sasl_client(SCRAM-SHA-256) authentication plugin.
- WL#14206, Support for authentication_ldap_sasl_client(GSSAPI) authentication plugin.
- WL#14207, Replace language in APIs and source code/docs. Changes in 8.0.22
- Bug#98667 (31711961), 'All pipe instances are busy' exception on multiple connections to named Pipe.
- Bug#96309 (31699357), MultiHost in loadbalance may lead to a TPS reduction during a quick switch.
- Bug#99076 (31083755), Unclear exception/error when connecting with jdbc:mysql to a mysqlx port.
- Bug#96870 (30304764), Contribution: Allow to disable AbandonedConnectionCleanupThread completely.
- WL#14115, Support for authentication_ldap_sasl_client (SCRAM-SHA-1) authentication plugin.
- WL#14096, Add option to specify LOAD DATA LOCAL allow list folder.
- WL#13780, Skip system-wide trust and key stores (incl. X DevAPI client certs).
- WL#14017, XProtocol – support for configurable compression algorithms.
- Bug#92903 (28834903), MySQL Connector/j should support wildcard names or alternative names.
- Bug#99767 (31443178), Contribution: Check SubjectAlternativeName for TLS instead of commonName.
- Bug#93444 (29015453), LOCALDATETIME PARAMETER VA UES ALTERED WHEN CLIENT AND SERVER TIMEZONES DIFFER.
- WL#14052, Remove asynchronous variant of X Protocol.
- Bug#99713 (31418928), NPE DURING COM.MYSQL.CJ.SERVERPREPAREDQUERYBINDVALUE.STOREDATE().
- WL#14068, Remove legacy integration with JBoss. Changes in 8.0.21
- WL#14051, Upgrade Protocol Buffers dependency to protobuf-java-3.11.4.
- WL#14042, Upgrade testsuite to JUnit 5.
- Bug#98237 (30911870), PREPAREDSTATEMENT.SETOBJECT(I, 'FALSE', TYPES.BOOLEAN) ALWAYS SETS TRUE OR 1.
- WL#13008, DevAPI: Add schema validation to create collection. Changes in 8.0.20
- Bug#30805426, IN CASE OF ISAUTHMETHODSWITCHREQUESTPACKET , TOSERVERS > 1 ARE IGNORED.
- Bug#97714 (30570249), Contribution: Expose elapsed time for query interceptor
- Bug#97724 (30570721), Contribution: Allow '3.' formatted numbers.
- Bug#98536 (30877755), SIMPLEDATEFORMAT COULD CACHE A WRONG CALENDAR. Fix for Bug#91112 (28125069), AGAIN WRONG JAVA.SQL.DATE.
- Bug#30474158, CONNECTOR/J 8 DOES NOT HONOR THE REQUESTED RESULTSETTYPE SCROLL_INSENSITIVE ETC.
- Bug#98445 (30832513), Connection option clientInfoProvider=ClientInfoProviderSP causes NPE.
- WL#12248, DevAPI: Connection compression.
- Bug#30636056, ResultSetUtil.resultSetToMap() can be unsafe to use.
- Bug#97757 (30584907), NULLPOINTEREXCEPTION WITH CACHERESULTSETMETADATA=TRUE AND EXECUTEQUERY OF 'SET'. Changes in 8.0.19
- WL#13346, Support for mult-host and failover.
- Bug#97413 (30477722), DATABASEMETADATA IS BROKEN AFTER SERVER WL#13528.
- WL#13367, DNS SRV support.
- WL#12736, DevAPI: Specify TLS ciphers to be used by a client or session.
- Bug#96383 (30119545) RS.GETTIMESTAMP() HAS * DIFFERENT RESULTS FOR TIME FIELDS WITH USECURSORFETCH=TRUE.
- Bug#96059 (29999318), ERROR STREAMING MULTI RESULTSETS WITH MYSQL-CONNECTOR-JAVA 8.0.X.
- Bug#96442 (30151808), INCORRECT DATE ERROR WHEN CALLING GETMETADATA ON PREPARED STATEMENT. Changes in 8.0.18
- WL#13347, Connectors should handle expired password sandbox without SET operations.
- Bug#84098 (25223123), endless loop in LoadBalancedAutoCommitInterceptor.
- Bug#23721537, MULTI-SELECT WITH EXECUTEASYNC() GIVES IMPROPER ERROR.
- Bug#95741 (29898567), METADATA QUERY USES UPPER() AROUND NUMERIC EXPRESSION.
- Bug#20913289, PSTMT.EXECUTEUPDATE() FAILS WHEN SQL MODE IS NO_BACKSLASH_ESCAPES.
- Bug#80441 (22850444), SYNTAX ERROR ON RESULTSET.UPDATEROW() WITH SQL_MODE NO_BACKSLASH_ESCAPES. Changes in 8.0.17
- WL#13210, Generate Javadocs via ant.
- WL#12247, DevAPI: indexing array fields.
- WL#12726, DevAPI: Add overlaps and not_overlaps as operator.
- Bug#95503 (29821029), Operator IN not mapping consistently to the right X Plugin operation.
- WL#12942, Update README.md and add new CONTRIBUTING.md.
- WL#13125, Support fully qualified hostnames longer than 60 characters.
- Bug#95210 (29807741), ClassCastException in BlobFromLocator when connecting as jdbc:mysql:replication.
- Bug#29591275, THE JAR FILE NEEDS TO CONTAIN A README AND LICENSE FILE.
- WL#13124, Support new utf8mb4 bin collation.
- WL#13009, DevAPI: Deprecate methods.
- WL#11101, Remove de-cache and close of SSPSs on double call to close().
- Bug#89133 (27356869) CONTRIBUTION: UPDATE DA ABASEMETADATA.JAVA.
- Bug#11891000, DABATASEMETADATA.GETTABLES() IGNORES THE SCHEMA_PATTERN ARGUMENT.
- Bug#94101 (29277648), SETTING LOGSLOWQUERIES SHOULD NOT AUTOMATICALLY ENABLE PROFILESQL FOR QUERIES.
- Bug#74690 (20010454), PROFILEREVENT HOSTNAME HAS NO GETTER().
- Bug#70677 (17640628), CONNECTOR J WITH PROFILESQL - LOG CONTAINS LOTS OF STACKTRACE DATA.
- Bug#41172 (11750577), PROFILEREVENT.PACK() THROWS ARRAYINDEXOUTOFBOUNDSEXCEPTION.
- Bug#27453692, CHARACTERS GET GARBLED IN CONCAT() IN PS WHEN USECURSORFETCH=TRUE.
- Bug#94585 (29452669), GETTABLENAME() RETURNS NULL FOR A QUERY HAVING COUNT(*) WITH JDBC DRIVER V8.0.12.
- Bug#94442 (29446059), RESULTSET
Which versions are affected by SUSE-SU-2023:3187-1?
Linux distribution packages (2)
javapackages-tools SUSE:Linux Enterprise Server 12 SP5 | All versions | 5.3.1-14.3.1 |
javapackages-tools SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 5.3.1-14.3.1 |
How do I fix SUSE-SU-2023:3187-1?
Upgrade to a fixed version.
Is SUSE-SU-2023:3187-1 being exploited?
There is no known exploitation of SUSE-SU-2023:3187-1 in the wild and no public exploit code.