SUSE-RU-2024:0225-1: Recommended update for ant and and-contrib
This update for ant and ant-contrib fixes the following issues: ant: ant was updated from version 1.10.13 to 1.10.14: Changes that could break older environments: Resource#compareTo now invokes getName rather than toString as the later may be costly (for example in the case of a StringResource). When using Java 18 or higher, Ant will no longer use Java SecurityManager because it has been deprecated for removal and by default is disallowed to be set at runtime https://openjdk.org/jeps/411. This will mean that the "<permissions>" type is no longer functional when using Java 18 or higher. Furthermore, when using Java 18 or higher, if the build executes tasks that call "java.lang.System.exit()" and if those tasks aren't running in a forked VM of their own, then such tasks will now kill the entire Ant build process. It is recommended that such tasks be updated to launch in a forked VM so that the System.exit() call will not impact the JVM in which Ant process runs.
Fixed bugs: Log only the stylesheet name in the xslt task. junitlauncher task's "test" and "listener" elements which take a "outputDir" property were incorrectly resolving the outputDir against the current working directory instead of the project's basedir. regexmapper would, in some cases, incorrectly consume backslash characters from the "to" attribute, resulting in missing backslashes in the output. <fixcrlf>, <replace> and <replaceregexp> now try to preserve the file permissions of the files they modify. junitlauncher task would fail if a forked test timed out even if haltOnFailure was set to false. Fixed a bug in org.apache.tools.zip.ZipOutputStream where, even when "zip64Mode" is set to "always", ZipOutputStream may not create a CEN extra field data for the entry. legacy-xml listener of junitlauncher task wouldn't report certain failures involving junit jupiter dynamic tests. allow.class which was introduced in Ant 1.10.13 release, has been removed from this 1.10.14 release. This class was introduced in context of the SecurityManager changes in Ant 1.10.13, which have now been reverted in Ant 1.10.14, since they caused several regressions.
Other changes: <fork> element of the junitlauncher task now has a new optional "java" attribute which can be used to point to a different Java installation for runnning the forked tests. Made sure <echoproperties> sorts the echoed properties on JDK9+ as well. org.apache.tools.ant.taskdefs.Recorder class now introduces a setLogLevel(LogLevel level) method. The <fork> element of junitlaunchertask now allows a "forkMode" attribute. forkMode=perTestClass can now be used to launch each test class in a separate forked JVM. ant-contrib: Package was rebuilt against ant version 1.10.14 to prevent installation issues (no source changes)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/ant-contribto a version that resolves this vulnerability.Fixed in 1.0b3-150200.11.12.2 - Upgrade
Upgrade
suse/ant-jakartamailto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-apache-regexpto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-antlrto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-jdependto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-scriptsto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-apache-bcelto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-jmfto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-swingto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-manualto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-commons-loggingto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-javamailto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-junitto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-apache-bsfto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-apache-oroto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-apache-log4jto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-apache-resolverto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/antto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-junit5to a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-contrib-javadocto a version that resolves this vulnerability.Fixed in 1.0b3-150200.11.12.2 - Upgrade
Upgrade
suse/ant-commons-netto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-imageioto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-testutilto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-xzto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-jschto a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
suse/ant-contrib-manualto a version that resolves this vulnerability.Fixed in 1.0b3-150200.11.12.2 - Upgrade
Upgrade
suse/ant-apache-xalan2to a version that resolves this vulnerability.Fixed in 1.10.14-150200.4.18.2 - Upgrade
Upgrade
Apache Antto a version that resolves this vulnerability.Fixed in 1.10.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-Storage-7.1-2024-225=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-225=1
Event History
Frequently Asked Questions
Which environments could see behavior changes after applying this update?
Build environments using Java 18 or later are affected by the SecurityManager change. In those environments, Ant's <permissions> type is no longer functional because Ant no longer uses Java SecurityManager.
What build tasks may need changes before updating?
On Java 18 or later, non-forked tasks that call java.lang.System.exit() can terminate the entire Ant build process. Update those tasks to launch in their own forked VM so that System.exit() does not affect the JVM running Ant.
Are all listed Ant-related packages necessarily affected by the Java 18 behavior changes?
The described behavior changes apply to Ant when it is run on Java 18 or higher. The update lists ant-contrib and several Ant-related packages, but the provided information does not identify which individual packages use <permissions> or execute tasks that call System.exit().