SUSE-RU-2024:0163-1: Recommended update for google-guice
This update for google-guice fixes the following issues: google-guice was updated from version 4.1 to 5.1.0: Changes of version 4.2: Added Java 9 and JPMS support Multibindings are now in the Guice core artifact. The multibindings artifact is empty to prevent confusion during upgrading and will be removed in a later release. Improved the performance of guice provisioning (by about 20%) by changing the way errors are reported. Guice will no longer report multiple errors during provisioning (Guice still reports multiple errors during injector creation). Improved error messages for a missing binding. AbstractModule.configure() is non-abstract to allow modules with only @Provides/@ProvidesIntoSet/... methods. Added a CheckedProviders class. Changed the way Singletons work to not rely on ThreadLocals nor WeakReferences. Added MapBinderBinding.getEntries(Iterable). Deprecated ProvisionListener.ProvisionInvocation .getDependencyChain(). Ensure that Struts interceptors are populated even if they are created after the injector (Fixes #1081, #1075). Added support for multibindings with annotations in the Guice DaggerMethodScanner.
Changes of version 4.2.1: Added Java 10 support (updated cglib & asm). Minor updates to the testlib extension.
Changes of version 4.2.2: Added Java 11 support (updated cglib & asm)
Changes of version 4.2.3: Added Java 14 support (updated asm). Added Injector.getElements API, to expose all Element SPI types from the Injector. Added Injector.getAllMembersInjectorInjectionPoints API, to expose injection points created by arbitrary members injection. Added getAlternateKeys to Multibinder SPI types (MultibinderBinding, MapBinderBinding, OptionalBinderBinding), to explicitly list the other keys these bindings are available as. Scan for (and bind) @Provides-like methods in a consistent ordering, rather than relying on the non-deterministic Class.getDeclaredMembers ordering. Updated DaggerAdapter to work with newer dagger code. Fixed a subtle bug with eager singleton evaluation. Updated @RequestScope's scope annotation to the JSR330 @Scope, so it can be reused by non-Guice DI systems. Clarified the error message when an injectable constructor is missing. Added deprecated overloads to various Modules methods, to make it clearer when calling them is unnecessary. Added factory methods to Modules for common Binder configuration methods, to make it easier to configure them.
Changes of version 5.0.1: Added Java 15 support (updated asm and bug fixes). Removed cglib as a core dependency. Improved error messages. Improved support for using Guice with Kotlin. Added a mechanism to restrict who can bind types or annotations, to allow library authors to control their bindings. Removed no-aop build variant. Fixed 'illegal reflective access' warnings.
Changes of version 5.1.0: Added support for Java 17.
Generate the ant build system using the maven pom files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/google-guiceto a version that resolves this vulnerability.Fixed in 5.1.0-150200.3.7.1 - Upgrade
Upgrade
suse/guice-grapherto a version that resolves this vulnerability.Fixed in 5.1.0-150200.3.7.1 - Upgrade
Upgrade
suse/guice-assistedinjectto a version that resolves this vulnerability.Fixed in 5.1.0-150200.3.7.1 - Upgrade
Upgrade
suse/google-guice-javadocto a version that resolves this vulnerability.Fixed in 5.1.0-150200.3.7.1 - Upgrade
Upgrade
suse/guice-jmxto a version that resolves this vulnerability.Fixed in 5.1.0-150200.3.7.1 - Upgrade
Upgrade
suse/guice-extensionsto a version that resolves this vulnerability.Fixed in 5.1.0-150200.3.7.1 - Upgrade
Upgrade
suse/guice-throwingprovidersto a version that resolves this vulnerability.Fixed in 5.1.0-150200.3.7.1 - Upgrade
Upgrade
suse/guice-jndito a version that resolves this vulnerability.Fixed in 5.1.0-150200.3.7.1 - Upgrade
Upgrade
suse/guice-parentto a version that resolves this vulnerability.Fixed in 5.1.0-150200.3.7.1 - Upgrade
Upgrade
suse/guice-bomto a version that resolves this vulnerability.Fixed in 5.1.0-150200.3.7.1 - Upgrade
Upgrade
suse/guice-servletto a version that resolves this vulnerability.Fixed in 5.1.0-150200.3.7.1 - Upgrade
Upgrade
google-guiceto a version that resolves this vulnerability.Fixed in 5.1.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Development-Tools-15-SP4-2024-163=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-163=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-163=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2024-163=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-163=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-163=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-163=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-163=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-163=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-Storage-7.1-2024-163=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.4-2024-163=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-163=1
Event History
Frequently Asked Questions
Which packages are covered by this update?
The update covers google-guice and related packages: guice-grapher, guice-assistedinject, google-guice-javadoc, guice-jmx, guice-extensions, guice-throwingproviders, and guice-jndi.
What version change does the update make?
It updates google-guice from version 4.1 to 5.1.0.
Does the advisory identify specific CVEs or exploit conditions?
No specific CVE identifiers, affected configurations, attacker requirements, or mitigation steps are provided in the available advisory data.