SUSE SLED15 / SLES15 / openSUSE 15 Security Update : mockito, snakeyaml, testng (SUSE-SU-2024:2568-1)

high Nessus Plugin ID 203007

Synopsis

The remote SUSE host is missing a security update.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2568-1 advisory.

mockito was updated to version 5.11.0:

- Added bundle manifest to the mockito-core artifact
- Mockito 5 is making core changes to ensure compatibility with future JDK versions.
- Switch the Default MockMaker to mockito-inline (not applicable to mockito-android)

* Mockito 2.7.6 introduced the mockito-inline mockmaker based on the 'inline bytecode' principle, offering compatibility advantages over the subclass mockmaker
* This change avoids JDK restrictions, such as violating module boundaries and leaking subclass creation

- Legitimate use cases for the subclass mockmaker:

* Scenarios where the inline mockmaker does not function, such as on Graal VM's native image
* If avoiding mocking final classes, the subclass mockmaker remains a viable option, although issues may arise on JDK 17+
* Mockito aims to support both mockmakers, allowing users to choose based on their requirements.

- Update the Minimum Supported Java Version to 11

* Mockito 5 raised the minimum supported Java version to 11
* Community member @reta contributed to this change.
* Users still on JDK 8 can continue using Mockito 4, with minimal API differences between versions

- New type() Method on ArgumentMatcher

* The ArgumentMatcher interface now includes a new type() method to support varargs methods, addressing previous limitations
* Users can now differentiate between matching calls with any exact number of arguments or match any number of arguments
* Mockito 5 provides a default implementation of the new method, ensuring backward compatibility.
* No obligation for users to implement the new method; Mockito 5 considers Void.type by default for varargs handling
* ArgumentCaptor is now fully type-aware, enabling capturing specific subclasses on a generic method.

- byte-buddy does not bundle asm, but uses objectweb-asm as external library

snake-yaml was updated to version 2.2:

- Changes of version 2.2:

* Define default scalar style as PLAIN (for polyglot Maven)
* Add missing 'exports org.yaml.snakeyaml.inspector' to module-info.java

- Changes of version 2.1:

* Heavy Allocation in Emitter.analyzeScalar(String) due to Regex Overhead
* Use identity in toString() for sequences to avoid OutOfMemoryError
* NumberFormatException from SnakeYAML due to int overflow for corrupt YAML version
* Document size limit should be applied to single document notthe whole input stream
* Detect invalid Unicode code point (thanks to Tatu Saloranta)
* Remove Trusted*Inspector classes from main sources tree

- Changes of version 2.0:

* Rollback to Java 7 target
* Add module-info.java
* Migrate to Java 8
* Remove many deprecated constructors
* Remove long deprecated methods in FlowStyle
* Do not allow global tags by default
* Yaml.LoadAs() signature to support Class<? super T> type instead of Class<T>
* CustomClassLoaderConstructor takes LoaderOptions
* Check input parameters for non-null values

testng was updated to version 7.10.1:

- Security issues fixed:

* CVE-2022-4065: Fixed Zip Slip Vulnerability (bsc#1205628)

- Changes of version 7.10.1:

* Fixed maven build with junit5

- Changes of version 7.10.0:

* Minor discrepancy fixes
* Deleting TestNG eclipse plugin specific classes
* Remove deprecated JUnit related support in TestNG
* Handle exceptions in emailable Reporter
* Added wrapperbot and update workflow order
* Support ITestNGFactory customisation
* Streamlined data provider listener invocation
* Streamlined Guice Module creation in concurrency.
* Copy test result attributes when unexpected failures
* chore: use explicit dependency versions instead of refreshVersions
* Removed Ant
* Support ordering of listeners
* Added errorprone
* Allow custom thread pool executors to be wired in.
* Allow data providers to be non cacheable
* Use Locks instead of synchronised keyword
* Document pgp artifact signing keys
* Added Unique Id for all test class instances
* Added issue management workflows
* Map object to configurations
* Allow listeners to be disabled at runtime
* Streamlined Data Provider execution
* Honour inheritance when parsing listener factories
* Tweaks around accessing SuiteResult
* Streamlined random generation
* Streamlined dependencies for configurations

- Changes of version 7.9.0:

* Fixed maps containing nulls can be incorrectly considered equal
* Test Results as artifacts for failed runs
* Fixed data races
* Dont honour params specified in suite-file tag
* Decouple SuiteRunner and TestRunner
* Disable Native DI for BeforeSuite methods
* Streamlined running Parallel Dataproviders+retries
* Removed extra whitespace in log for Configuration.createMethods()
* Added the link for TestNG Documentation's GitHub Repo in README.md
* FirstTimeOnlyConfig methods + Listener invocations
* Added overrideGroupsFromCliInParentChildXml test
* Ensure thread safety for attribute access
* Added @inherited to the Listeners annotation
* Restrict Group inheritance to Before|AfterGroups
* Ensure ITestResult injected to @AfterMethod is apt
* Support suite level thread pools for data provider
* Favour CompletableFuture instead of PoolService
* Favour FutureTask for concurrency support
* Shared Threadpool for normal/datadriven tests.
* Abort for invalid combinations

- Changes of version 7.8.0:

* [Feature] Not exception but warning if some (not all) of the given test names are not found in suite files.
* [Feature] Generate testng-results.xml per test suite
* [Feature] Allow test classes to define 'configfailurepolicy' at a per class level
* XmlTest index is not set for test suites invoked with YAML
* Listener's onAfterClass is called before @afterclass configuration methods are executed.
* After upgrading to TestNG 7.5.0, setting ITestResult.status to FAILURE doesn't fail the test anymore
* JUnitReportReporter should capture the test case output at the test case level
* TestNG.xml doesn't honour Parallel value of a clone
* before configuration and before invocation should be 'SKIP' when beforeMethod is 'skip'
* Test listeners specified in parent testng.xml file are not included in testng-failed.xml file
* Discrepancies with DataProvider and Retry of failed tests
* Skipped Tests with DataProvider appear as failed
* testng-results xml reports config skips from base classes as ignored
* Feature: Check that specific object present in List
* Upgraded snakeyaml to 2.0

- Changes of version 7.7.1:

* Streamline overloaded assertion methods for Groovy

- Changes of version 7.7.0:

* Replace FindBugs by SpotBugs
* Gradle: Drop forUseAtConfigurationTime()
* Added ability to provide custom message to assertThrows\expectThrows methods
* Only resolve hostname once
* Prevent overlogging of debug msgs in Graph impl
* Streamlined dataprovider invoking in abstract classes
* Streamlined TestResult due to expectedExceptions
* Unexpected test runs count with retry analyzer
* Make PackageUtils compliant with JPMS
* Ability to retry a data provider during failures
* Fixing bug with DataProvider retry
* Added config key for callback discrepancy behavior
* Fixed FileAlreadyExistsException error on copy
* JarFileUtils.delete(File f) throw actual exception (instead of FileNotFound) when file cannot be deleted #2825
* Changing assertion message of the osgitest
* Enhancing the Matrix
* Avoid Compilation errors on Semeru JDK flavour.
* Add addition yml extension
* Support getting dependencies info for a test
* Honour regex in dependsOnMethods
* Ensure All tests run all the time
* Deprecate support for running Spock Tests
* Streamline dependsOnMethods for configurations
* Ensure ITestContext available for JUnit4 tests
* Deprecate support for running JUnit tests
* Changes of 7.6.1
* Fix Files.copy() such that parent dirs are created
* Remove deprecated utility methods

- Changes of version 7.6.0:

* Remove redundant Parameter implementation
* Upgraded to JDK11
* Move SimpleBaseTest to be Kotlin based
* Restore testnames when using suites in suite.
* Moving ClassHelperTests into Kotlin
* IHookable and IConfigurable callback discrepancy
* Minor refactoring
* Add additional condition for assertEqualsNoOrder
* beforeConfiguration() listener method should be invoked for skipped configurations as well
* Keep the initial order of listeners
* SuiteRunner could not be initial by default Configuration
* Enable Dataprovider failures to be considered.
* BeforeGroups should run before any matched test
* Fixed possible StringIndexOutOfBoundsException exception in XmlReporter
* DataProvider: possibility to unload dataprovider class, when done with it
* Fixed possibilty that AfterGroups method is invoked before all tests
* Fixed equals implementation for WrappedTestNGMethod
* Wire-In listeners consistently
* Streamline AfterClass invocation
* Show FQMN for tests in console
* Honour custom attribute values in TestNG default reports

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 203007

File Name: suse_SU-2024-2568-1.nasl

Version: 1.1

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 7/23/2024

Updated: 7/23/2024

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-4065

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:snakeyaml, p-cpe:/a:novell:suse_linux:testng, p-cpe:/a:novell:suse_linux:mockito

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/22/2024

Vulnerability Publication Date: 11/19/2022

Reference Information

CVE: CVE-2022-4065

SuSE: SUSE-SU-2024:2568-1

Detections

Analytics