SUSE-RU-2024:0163-1: Recommended update for google-guice

Published Jan 19, 2024
·
Updated

This update for google-guice fixes the following issues: google-guice was updated from version 4.1 to 5.1.0: Changes of version 4.2: Added Java 9 and JPMS support Multibindings are now in the Guice core artifact. The multibindings artifact is empty to prevent confusion during upgrading and will be removed in a later release. Improved the performance of guice provisioning (by about 20%) by changing the way errors are reported. Guice will no longer report multiple errors during provisioning (Guice still reports multiple errors during injector creation). Improved error messages for a missing binding. AbstractModule.configure() is non-abstract to allow modules with only @Provides/@ProvidesIntoSet/... methods. Added a CheckedProviders class. Changed the way Singletons work to not rely on ThreadLocals nor WeakReferences. Added MapBinderBinding.getEntries(Iterable). Deprecated ProvisionListener.ProvisionInvocation .getDependencyChain(). Ensure that Struts interceptors are populated even if they are created after the injector (Fixes #1081, #1075). Added support for multibindings with annotations in the Guice DaggerMethodScanner.

Changes of version 4.2.1: Added Java 10 support (updated cglib & asm). Minor updates to the testlib extension.

Changes of version 4.2.2: Added Java 11 support (updated cglib & asm)

Changes of version 4.2.3: Added Java 14 support (updated asm). Added Injector.getElements API, to expose all Element SPI types from the Injector. Added Injector.getAllMembersInjectorInjectionPoints API, to expose injection points created by arbitrary members injection. Added getAlternateKeys to Multibinder SPI types (MultibinderBinding, MapBinderBinding, OptionalBinderBinding), to explicitly list the other keys these bindings are available as. Scan for (and bind) @Provides-like methods in a consistent ordering, rather than relying on the non-deterministic Class.getDeclaredMembers ordering. Updated DaggerAdapter to work with newer dagger code. Fixed a subtle bug with eager singleton evaluation. Updated @RequestScope's scope annotation to the JSR330 @Scope, so it can be reused by non-Guice DI systems. Clarified the error message when an injectable constructor is missing. Added deprecated overloads to various Modules methods, to make it clearer when calling them is unnecessary. Added factory methods to Modules for common Binder configuration methods, to make it easier to configure them.

Changes of version 5.0.1: Added Java 15 support (updated asm and bug fixes). Removed cglib as a core dependency. Improved error messages. Improved support for using Guice with Kotlin. Added a mechanism to restrict who can bind types or annotations, to allow library authors to control their bindings. Removed no-aop build variant. Fixed 'illegal reflective access' warnings.

Changes of version 5.1.0: Added support for Java 17.

Generate the ant build system using the maven pom files.

Affected Software

44 affected componentsFixes available
All of the following
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch)
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
All of the following
SUSE SUSE Enterprise Storage 7.1 (noarch)
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
All of the following
SUSE openSUSE Leap 15.4 (noarch)
Any of the following
suse/guice-grapher<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-assistedinject<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/google-guice-javadoc<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-jmx<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-extensions<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-throwingproviders<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-jndi<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-parent<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-bom<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-servlet<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
All of the following
SUSE openSUSE Leap 15.5 (noarch)
Any of the following
suse/guice-grapher<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-assistedinject<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/google-guice-javadoc<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-jmx<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-extensions<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-throwingproviders<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-jndi<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-parent<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-bom<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
suse/guice-servlet<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
All of the following
SUSE Development Tools Module 15-SP4 (noarch)
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
All of the following
SUSE Development Tools Module 15-SP5 (noarch)
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
All of the following
SUSE SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch)
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
All of the following
SUSE SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch)
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
All of the following
SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch)
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
All of the following
SUSE SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch)
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
All of the following
SUSE SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch)
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1
All of the following
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch)
suse/google-guice<5.1.0-150200.3.7.1
5.1.0-150200.3.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade suse/google-guice to a version that resolves this vulnerability.

    Fixed in 5.1.0-150200.3.7.1
  2. Upgrade

    Upgrade suse/guice-grapher to a version that resolves this vulnerability.

    Fixed in 5.1.0-150200.3.7.1
  3. Upgrade

    Upgrade suse/guice-assistedinject to a version that resolves this vulnerability.

    Fixed in 5.1.0-150200.3.7.1
  4. Upgrade

    Upgrade suse/google-guice-javadoc to a version that resolves this vulnerability.

    Fixed in 5.1.0-150200.3.7.1
  5. Upgrade

    Upgrade suse/guice-jmx to a version that resolves this vulnerability.

    Fixed in 5.1.0-150200.3.7.1
  6. Upgrade

    Upgrade suse/guice-extensions to a version that resolves this vulnerability.

    Fixed in 5.1.0-150200.3.7.1
  7. Upgrade

    Upgrade suse/guice-throwingproviders to a version that resolves this vulnerability.

    Fixed in 5.1.0-150200.3.7.1
  8. Upgrade

    Upgrade suse/guice-jndi to a version that resolves this vulnerability.

    Fixed in 5.1.0-150200.3.7.1
  9. Upgrade

    Upgrade suse/guice-parent to a version that resolves this vulnerability.

    Fixed in 5.1.0-150200.3.7.1
  10. Upgrade

    Upgrade suse/guice-bom to a version that resolves this vulnerability.

    Fixed in 5.1.0-150200.3.7.1
  11. Upgrade

    Upgrade suse/guice-servlet to a version that resolves this vulnerability.

    Fixed in 5.1.0-150200.3.7.1
  12. Upgrade

    Upgrade google-guice to a version that resolves this vulnerability.

    Fixed in 5.1.0
  13. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Module-Development-Tools-15-SP4-2024-163=1
  14. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-163=1
  15. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-163=1
  16. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2024-163=1
  17. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-163=1
  18. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-163=1
  19. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-163=1
  20. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-163=1
  21. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-163=1
  22. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-Storage-7.1-2024-163=1
  23. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch openSUSE-SLE-15.4-2024-163=1
  24. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch openSUSE-SLE-15.5-2024-163=1

Event History

Jan 19, 2024
Advisory Published
via SUSE·08:30 AM

Frequently Asked Questions

1

Which packages are covered by this update?

The update covers google-guice and related packages: guice-grapher, guice-assistedinject, google-guice-javadoc, guice-jmx, guice-extensions, guice-throwingproviders, and guice-jndi.

2

What version change does the update make?

It updates google-guice from version 4.1 to 5.1.0.

3

Does the advisory identify specific CVEs or exploit conditions?

No specific CVE identifiers, affected configurations, attacker requirements, or mitigation steps are provided in the available advisory data.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203