DSA-5227: -1 libgoogle-gson-java -- security update
It was discovered that Gson, a Java library that can be used to convert Java Objects into their JSON representations and vice versa, was vulnerable to a deserialization flaw. An application would de-serialize untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution. This can lead to a denial of service or even the execution of arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libgoogle-gson-javato a version that resolves this vulnerability.Patch DSA-5227-1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Gson are exposed if they deserialize untrusted data. The described impact depends on an attacker being able to influence the data passed to Gson for deserialization.
What could an attacker achieve?
An attacker may be able to control application state or execution flow through insufficiently validated deserialization. The advisory states this can result in denial of service or arbitrary code execution.
How can I determine whether my application may be affected?
Review where the application uses Gson to deserialize data and identify inputs originating from untrusted sources. Systems that only deserialize trusted data are not identified as exposed by the advisory.