SUSE-RU-2024:0096-1: Recommended update for replacer, velocity
This update for replacer, velocity fixes the following issues: replacer: Port from commons-lang to commons-lang3 velocity: Reduce considerably the dependencies graph Port from apache-commons-lang to apache-commons-lang3 Make JDK's own logging provider as default
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/velocity-manualto a version that resolves this vulnerability.Fixed in 1.7-150200.3.10.1 - Upgrade
Upgrade
suse/velocityto a version that resolves this vulnerability.Fixed in 1.7-150200.3.10.1 - Upgrade
Upgrade
suse/velocity-demoto a version that resolves this vulnerability.Fixed in 1.7-150200.3.10.1 - Upgrade
Upgrade
suse/replacer-javadocto a version that resolves this vulnerability.Fixed in 1.6-150200.3.7.5 - Upgrade
Upgrade
suse/velocity-javadocto a version that resolves this vulnerability.Fixed in 1.7-150200.3.10.1 - Upgrade
Upgrade
suse/replacerto a version that resolves this vulnerability.Fixed in 1.6-150200.3.7.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Development-Tools-15-SP4-2024-96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2024-96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-Storage-7.1-2024-96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.4-2024-96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-96
Event History
Frequently Asked Questions
Which systems and packages are covered by this update?
The update applies to SUSE openSUSE Leap 15.4 and 15.5 noarch packages. Covered packages include replacer, replacer-javadoc, velocity, velocity-manual, velocity-demo, and velocity-javadoc.
Does the advisory identify a specific security vulnerability or exploitation method?
No. The provided information describes a recommended update that ports components to commons-lang3, reduces Velocity's dependency graph, and changes the default logging provider; it does not identify a CVE, attack vector, or exploitation prerequisites.
How can I determine whether a system needs the update?
Check whether the system runs openSUSE Leap 15.4 or 15.5 and has any of the listed replacer or Velocity packages installed. The provided information does not include fixed package versions, so it cannot be used to determine patch status by version alone.