xstream-benchmark-1.4.18-lp152.2.12.1<>,GaoϦ/=„ơ^ANٺ!H^=5fp{a6)8M #_a^}._8_ҏ]san_Z[Ԕ9nC%"oPI@n2@E~xuw?߈[ ;&v‡?b֧"(YA}K1ynx(:k  ԭzb+{Ii3l!~r0)0MAIz~YPFy `֭iM`9%DJN0)uu<>> <? ,d ( I  < J X t ; | (8 9 : FGHIXY\]4^b5cduezf}luvw|xyz (Cxstream-benchmark1.4.18lp152.2.12.1The benchmark module for xstreamThis package contains the benchmark module for xstream.aoϦobs-arm-11openSUSE Leap 15.2openSUSEBSD-3-Clausehttp://bugs.opensuse.orgDevelopment/Libraries/Javahttps://x-stream.github.io/linuxnoarchg2AAaoϟaoϟaoϟaoϟaoϟaoϟaoϟ7f01a3417ebd525e118383f1ed9650c8ba8a920e47aa8a70683342ec8694599274061763abd6b5bac99c3d386a71cc7cbc984eecba55e91ad1e4a6bd0ee81e4eb8b5dc0d915b731ed05fd0334f50e7186c46d0338190a3d4401c2715f9e971b5xstream/xstream-benchmark.jarxstream/xstream-benchmark.pomrootrootrootrootrootrootrootrootrootrootrootrootrootrootxstream-1.4.18-lp152.2.12.1.src.rpmmvn(com.thoughtworks.xstream:xstream-benchmark)mvn(com.thoughtworks.xstream:xstream-benchmark:pom:)osgi(xstream-benchmark)xstream-benchmark@ @@    java-headlessjavapackages-filesystemmvn(com.thoughtworks.xstream:xstream)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)xstream1.81.4.183.0.4-14.6.0-14.0-15.2-11.4.18-lp152.2.12.14.14.1aS``x*`Gc@\~d\Yz\Z!D@Z@WVn@VA@Fridrich Strba Fridrich Strba Fridrich Strba Johannes Renner Frantisek Kobzik michele.bologna@suse.commoio@suse.commc@suse.comjgonzalez@suse.commoio@suse.commoio@suse.commoio@suse.com- Upgrade to 1.4.18 * Security fixes + This maintenance release addresses following security vulnerabilities, when unmarshalling with an XStream instance using the default blacklist of an uninitialized security framework. XStream is therefore now using a whitelist by default. (CVE-2021-39139, CVE-2021-39140, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145, CVE-2021-39146, CVE-2021-39147, CVE-2021-39148, CVE-2021-39149, CVE-2021-39150, CVE-2021-39151, CVE-2021-39152, CVE-2021-39153, CVE-2021-39154, bsc#1189798) * Minor changes + Support serializable types with non-serializable parent with PureJavaReflectionConverter. * Stream compatibility + Starting with version 1.14.12 nine years ago, XStream contains a Security Framework to implement a black- or whitelist for the allowed types at deserialization time. Until version 1.4.17, XStream kept a default blacklist in order to deny all types of the Java runtime, which are used for all kinds of security attacks, in order to guarantee optimal runtime compatibility for existing users. However, this approach has failed. The last months have shown, that the Java runtime alone contains dozens of types that can be used for an attack, not even looking at the 3rd party libraries on a classpath. The new version of XStream uses therefore now by default a whitelist, which is recommended since nine years. It also has been complaining on the console for a long time about an uninitialized security framework the first time it was run. Anyone who has followed the advice and initialized the security framework for their own scenario can easily update to the new version without any problem. Everyone else will have to do a proper initialization now, otherwise the new version will fail with certainty at deserialization time. - Modified patch: * Revert-MXParser-changes.patch + rediff to changed context- Upgrade to 1.4.17 * Security fix: * bsc#1186651, CVE-2021-29505: potential code execution when unmarshalling with XStream instances using an uninitialized security framework- Upgrade to 1.4.16 * Security fixes: + bsc#1184796, CVE-2021-21351: remote attacker to load and execute arbitrary code + bsc#1184797, CVE-2021-21349: SSRF can lead to a remote attacker to request data from internal resources + bsc#1184380, CVE-2021-21350: arbitrary code execution + bsc#1184374, CVE-2021-21348: remote attacker could cause denial of service by consuming maximum CPU time + bsc#1184378, CVE-2021-21347: remote attacker to load and execute arbitrary code from a remote host + bsc#1184375, CVE-2021-21344: remote attacker could load and execute arbitrary code from a remote host + bsc#1184379, CVE-2021-21342: server-side forgery + bsc#1184377, CVE-2021-21341: remote attacker could cause a denial of service by allocating 100% CPU time + bsc#1184373, CVE-2021-21346: remote attacker could load and execute arbitrary code + bsc#1184372, CVE-2021-21345: remote attacker with sufficient rights could execute commands + bsc#1184376, CVE-2021-21343: replace or inject objects, that result in the deletion of files on the local host - Add patch: * Revert-MXParser-changes.patch + revert changes that would force us to add new dependency- Upgrade to 1.4.15 * fixes bsc#1180146, CVE-2020-26258 and bsc#1180145, CVE-2020-26259 - Upgrade to 1.4.14 * fixes bsc#1180994, CVE-2020-26217 - Update xstream to 1.4.15~susemanager Removed: * xstream_1_4_10-jdk11.patch * xstream_1_4_10-buildsh-sle12.patch * build.sh- Update xstream to 1.4.10 Added: * xstream_1_4_10-jdk11.patch * xstream_1_4_10-buildsh-sle12.patch * xstream-XSTREAM_1_4_10.tar.gz Removed: * 0001-Prevent-deserialization-of-void.patch * xstream-XSTREAM_1_4_9.tar.gz * xstream-XSTREAM_1_4_9-jdk11.patch - Major changes: - New XStream artifact with -java7 appended as version suffix for a library explicitly without the Java 8 stuff (lambda expression support, converters for java.time.* package). - Fix PrimitiveTypePermission to reject type void to prevent CVE-2017-7957 with an initialized security framework. - Improve performance by minimizing call stack of mapper chain. - XSTR-774: Add converters for types of java.time, java.time.chrono, and java.time.temporal packages (converters for LocalDate, LocalDateTime, LocalTime, OffsetDateTime, and ZonedDateTime by Matej Cimbora). - JavaBeanConverter does not respect ignored unknown elements. - Add XStream.setupDefaultSecurity to initialize security framework with defaults of XStream 1.5.x. - Emit error warning if security framework has not been initialized and the XStream instance is vulnerable to known exploits.- Feat: modify patch to be compatible with JDK 11 building Added: * xstream-XSTREAM_1_4_9-jdk11.patch Removed: * xstream-XSTREAM_1_4_9-jdk9.patch- fixes for SLE 15 compatibility- fix possible Denial of Service when unmarshalling void. (CVE-2017-7957, bsc#1070731) Added: * 0001-Prevent-deserialization-of-void.patch- Fix build for JDK9 - Disable javadoc generation (broken for SLE15 and Tumbleweed) - Add: * xstream-XSTREAM_1_4_9-jdk9.patch - Changed: * build.sh- Require building on Java 8, otherwise the LambdaMapper class is skipped (issue 30)- Upgrade to version 1.4.9, which fixes CVE-2016-3674 (bsc#972950)- Initial versionobs-arm-11 16347176061.4.181.4.181.4.181.4.18-lp152.2.12.1xstreamxstream-benchmark.jarxstream-benchmark.jarxstream-xstream-benchmark.xmlxstreamxstream-benchmark.pomxstream-benchmark.pom/usr/share/java//usr/share/java/xstream//usr/share/maven-metadata//usr/share/maven-poms//usr/share/maven-poms/xstream/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:17071/openSUSE_Leap_15.2_Update_ports/1ac10c4a3ee1c623af3a4d55fa651d7b-xstream.openSUSE_Leap_15.2_Updatedrpmxz5noarch-suse-linuxdirectoryASCII text, with CRLF line terminators (Zip archive data, at least v2.0 to extract Zip archive data, at least v2.0 to extract)XML 1.0 document, ASCII textexported SGML document, ASCII textPPPRRR`-Y<ɡF>cutf-880fdf95524300d5905d23f0a77532020386684576a6389a290152ea0d8b3ffce? 7zXZ !t/IH"]"k%]ס%$X;VL`’980X@x҄ehg<55 ,WL]2mDFKss)'?lT՝)ˣExR~X `u.a{$2DU^aSWic~ZS&kӊmy,újʂДP:3@,A)Vq aBܙ:2V.49G ^+$2/ 3Dh$Bf(v&.‹|_zh37ړ+x|[txM6&,oU=ۀQN` ҕ9!T䥽9\$H-w-]~cAeCp #M@lyoVL2%2|,zZjM5zf:XQP_)S6ޘ&vydL]_M]uG%EZWdJ3tsΑ 2B7Wix2nmBͣ5Z!IZiR&k( Ɇvu_Zf),RB]cw{Q< yg+o6Ղ.UWȵ_pQN8]o#)~ݎ]%"@+ w?)Y- /@CyN6CR6@-Df.Iyx hHOLG49Nf[?y]>W b]Kۿ64('!{Ґؽ![!Gw?⟏=1tv 5C8O gGa&+9C[%ɿ^*CnScIq+Xj.uUHjrm$5P}8M=*~ݬ8^eNǖ>#q1Zѵ!$׻PtupF +\wCiЭNqL2rhU/,`%˲N>mI@yݐla5/q^G캮ê63Thxkad*5D\;t+r 9HݐN"@y(kKr@PJ/߅sXїD)@m`+_/SPl9 ##Gx9g d+t ?ƚVA /:X`}<~@-1x-M6 W̛x½S_Df\L@q,DLl CwEuNh}Ur:q89~,@R[E=^%.nfV#IKi[3ƑA_16?1yӆ\|{e~vw>)&yugڠ$a3Q@~@_zwIRNS:tx4[X@Bm"Ng>]{ɳ➧2v悎ߖ|!'BazqJ|Z [V3~<{X:HCV҇> 9 Zeo {mJ)F:"%/vLF^>«Q`E9DQiC ] n{L\niB Lh>>s U4K2}Ll4q=8Gd}>3 ,0}0Hov M*<⪔r2i/W~"!r؃D:5a5x_DeX =M_i)A-HlND Avy_#/K>q3E+f<"3 ~ PyhܕFHv6 3i ~NL0.N/Ubb}{k򸀷}9iDk(f *fvKtsL*rH=+4YK ðg4 {ԩϖaA8[2"WLN!p/welE3W0<rNx<p.! b\v>W۟.B s[|\S 1NH0aT!<Έu렉UK\'?gRNs %>Vqۈ W4}yr!v;& )GP\Z^k0sE2<]no1 EYx# 8݁힒Y~xþ(RT>1/OKU/y4$N!;̏)1[ $'n;Pw j߇T3 9 'oz38=YWwHLx|avRL X}k>Ŭ0q#KʏdBIbooc  -X /ⴹ|:ZlE8qLxvC[)07-H2O6B@[$EdW-b!m׮sUeU:&=󃠝$ᕱ f[33,˄,PGc5y`|Kw8A)O0,E+Ը`L )q{=O LB"$JDz&<4xpdk8c!):5Uq~=-5~Fhb7ԍ=4aw9Lh;#G|g$<{O 2* ^>ňYo %Gdwt=r-X~?V@iJ"Md D'55YߊmwCi 2Qk}2^ɪgy're)nC^H`n5P-p.EIGThkt ;ä*-[6Rgk?cq /ճКȶ~v׮i0m5WYܩ$[:OqaTƦ'ws|D?+4O,vD4鴘(s#bv@N^(.y9YlDv0|9YV#^1hA(coP4ipGOц. #[D'~)ZEXșUA4,7(a&rH{doZ PP1Mu\, ӉW+v:IeB*!>B6{N*gY s6_âv͡zhCv!u0GWl+l.%+~ 5%KJy`+Ɨac;tYFCS͆|lʩ ¼$WO҂M9R~.vNQY%RF|kJy]^p'wNy<(KSUT ~Uۂ$xxvԦj&fb̖J {IbT-L`NeU 溿yYHᵿW Nrnya/F ,HE3/`k48dVE-ǮvXQH1Q0u(++F9)%:΍:GX `( (G, EPxqsVq;9͑[e.vE4X ^FkhR;[fT/O]}P!Hw+=Fjc8!]-d-|-/5w?>BG W`S9X8[ʺɑ-ֳD1Yr\ v'6 {[PHEljHFNN/ ,w G ZM'0]Ί|A=O[?o8a43}<:)&ᡸ}]HFwf 2bvUR/ABYz5k$_qÈg1Q ՀV#1OF/VX(炚`Zq7Gm0Yӊ&;&9^>HdꃸՉe{k|+W7j`@PVeJ&p/렝iT~6Eܷ֌]]@lHEA>/I+7]; TtOjvlhV߭pIF|t<\n+V0")!PMӍWk}gf.vpOS y8Z;?K~<^HҩSVUJ/& Q1+dl41H׳bB/5:C"1hgd-:O9S>|:ݣ3ނhL;3O_'**LNaHȞeXHwpA+|` 1=#pT5w |)g7n 9n2FMYd*L/Yu~%LF~Ww89O* Uؙ PO^Ԇone ،AVɟ"A7`D2d{ʍV>QhX*QBbʈC_8HanRֳT 4wl=1嫶aC Ƹ SjBтw:kϣM=o?j]޲Tc\8) 6K.},F{t$z]Y_(.0KM8Vm&$)6u &Etٸ^*sG9G4-XMV h#(JB=y@XNkKeKen e_¦ 0@ 7Ns#}zrWoA+a)XvlZaUAé{W#sMwg.ܸ; =&\6^@4\ %kX$5-wk?/0&$̚kAi'KҒ8s_"w]AnBqFrО=ˆB F_egFUg$VZ^;=f7xh:댋=ՒsI 1cF}}ʕn?a9H<"c>s-\&UNνo̖Mfٽj{u@TR>s@n%s9w8VQ0]U}fN[GZru_Gb!bS'x$E׌$̌0eauݳ$SfLЮvNȚDUrkذ0_)Q 71f$%Xn&֏ xc("(藖q 2BaT߸.PuU$Aה52%kRa3Th݌h9mJD2Ω*+A}'.o`q퀗e}..|l"StɔRzI1-UbA[VGS&˾ss%>koO_M_?4nSmn\x:Fɒ9۶ YZ