[USN-6692-1] Gson vulnerability

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEELRdhz3KY7FGicMD8Vjg+NdFTuLIFAmXwjGEFAwAAAAAACgkQVjg+NdFTuLIx
KQv+KYuoFLNht8lM2qk/Ej7DRDaDG9mdNi9FsS9qjandeUhuy62mZw3JwXiK1aGlBoyVNSkGpZj5
XyJoCLvL374u3JygCPv0U357iLvHWnrfYZAFyP8652iwN/g5aJwCUZS56mYBytNqzwHEBeC4PxsT
TB7Q7wDQtJzcKlUq+Vjp3Rryk9ktpd5NEy8Qo8rOQ3l1tdEs76zCjiv20YyORGm8/vKtHnCb3jOy
JSVpn+zVNvvEj0VClcic8lDSPq6eO5KYuhLgiW/Aks1oHaXG9X+73+TXUDPemRb/3EAtijgl0/zS
dhvTC+SDL3Wgx3SwmLRRliXjpMULTjGszqgc560KebKidF2XI5Tm6Rktmjc5zbd+NqT4akTvt+hP
wmhuOMJ13O09TP0fCSmxVmaLH3MzirRgNP/6ZBsJntQwHyw8dDMQBlrdvJ2lt2YCR4sRZZAIDhkF
mBxgXx22/dqmbhiI5zXaPTG9D5wDJx8hrQCb/+1pyv3zyZwwCkT7GtqbKCxP
=DJVJ
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6692-1
March 12, 2024

libgoogle-gson-java vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)

Summary:

Gson could be made to crash if it opened a specially crafted
file.

Software Description:
- libgoogle-gson-java: A Java serialization/deserialization library to convert
Java Objects into JSON and back

Details:

It was discovered that Gson incorrectly handled deserialization of untrusted
input data. If a user or an automated system were tricked into opening a
specially crafted input file, a remote attacker could possibly use this issue
to cause a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
libgoogle-gson-java 2.8.8-1ubuntu0.1

Ubuntu 20.04 LTS:
libgoogle-gson-java 2.8.5-3+deb10u1build0.20.04.1

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libgoogle-gson-java 2.8.5-3~18.04.1~esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libgoogle-gson-java 2.4-1ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6692-1
CVE-2022-25647

Package Information:
https://launchpad.net/ubuntu/+source/libgoogle-gson-java/2.8.8-1ubuntu0.1

https://launchpad.net/ubuntu/+source/libgoogle-gson-java/2.8.5-3+deb10u1build0.20.04.1