bug#47342: [PATCH 2/2] gnu: java-xstream: Update to 1.4.16 [security fixes].

2021-03-23 Thread Julien Lepiller
So, mxparser seems to be pretty easy to package, but it depends on xmlpull v1. Unfortunately, it was developped at Extreme! Lab at Indiana University, but their website has recently been "deprecated" and redirects to the internet archive. This is an issue as we have xmlpull v2 and xpp3 whose so

bug#47342: [PATCH 2/2] gnu: java-xstream: Update to 1.4.16 [security fixes].

2021-03-23 Thread Leo Famulari
On Tue, Mar 23, 2021 at 03:38:40PM +0100, Léo Le Bouter via Bug reports for GNU Guix wrote: > Fixes CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, > CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, > CVE-2021-21349, CVE-2021-21350 and CVE-2021-21351. > > * gnu/pack

bug#47342: [PATCH 2/2] gnu: java-xstream: Update to 1.4.16 [security fixes].

2021-03-23 Thread Léo Le Bouter via Bug reports for GNU Guix
Fixes CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350 and CVE-2021-21351. * gnu/packages/xml.scm (java-xstream): Update to 1.4.16. [inputs]: Replace java-xpp3 with java-mxparser, the latt