# Security update for mockito, snakeyaml, testng

Announcement ID: SUSE-SU-2024:2568-1  
Rating: important  
References:

  * bsc#1205628

  
Cross-References:

  * CVE-2022-4065

  
CVSS scores:

  * CVE-2022-4065 ( SUSE ):  8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2022-4065 ( NVD ):  7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2022-4065 ( NVD ):  5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

  
Affected Products:

  * Development Tools Module 15-SP5
  * Development Tools Module 15-SP6
  * openSUSE Leap 15.5
  * openSUSE Leap 15.6
  * SUSE Enterprise Storage 7.1
  * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4
  * SUSE Linux Enterprise Desktop 15 SP5
  * SUSE Linux Enterprise Desktop 15 SP6
  * SUSE Linux Enterprise High Performance Computing 15 SP2
  * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2
  * SUSE Linux Enterprise High Performance Computing 15 SP3
  * SUSE Linux Enterprise High Performance Computing 15 SP4
  * SUSE Linux Enterprise High Performance Computing 15 SP5
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
  * SUSE Linux Enterprise Real Time 15 SP5
  * SUSE Linux Enterprise Real Time 15 SP6
  * SUSE Linux Enterprise Server 15 SP2
  * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
  * SUSE Linux Enterprise Server 15 SP3
  * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
  * SUSE Linux Enterprise Server 15 SP4
  * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4
  * SUSE Linux Enterprise Server 15 SP5
  * SUSE Linux Enterprise Server 15 SP6
  * SUSE Linux Enterprise Server for SAP Applications 15 SP2
  * SUSE Linux Enterprise Server for SAP Applications 15 SP3
  * SUSE Linux Enterprise Server for SAP Applications 15 SP4
  * SUSE Linux Enterprise Server for SAP Applications 15 SP5
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6
  * SUSE Manager Server 4.3
  * SUSE Manager Server 4.3 Module 4.3
  * SUSE Package Hub 15 15-SP6

  
  
An update that solves one vulnerability can now be installed.

## Description:

This update for mockito, snakeyaml, testng fixes the following issues:

mockito was updated to version 5.11.0:

  * Added bundle manifest to the mockito-core artifact
  * Mockito 5 is making core changes to ensure compatibility with future JDK
    versions.
  * Switch the Default MockMaker to mockito-inline (not applicable to mockito-
    android)

  * Mockito 2.7.6 introduced the mockito-inline mockmaker based on the "inline
    bytecode" principle, offering compatibility advantages over the subclass
    mockmaker

  * This change avoids JDK restrictions, such as violating module boundaries and
    leaking subclass creation

  * Legitimate use cases for the subclass mockmaker:

  * Scenarios where the inline mockmaker does not function, such as on Graal
    VM's native image

  * If avoiding mocking final classes, the subclass mockmaker remains a viable
    option, although issues may arise on JDK 17+
  * Mockito aims to support both mockmakers, allowing users to choose based on
    their requirements.

  * Update the Minimum Supported Java Version to 11

  * Mockito 5 raised the minimum supported Java version to 11

  * Community member @reta contributed to this change.
  * Users still on JDK 8 can continue using Mockito 4, with minimal API
    differences between versions

  * New type() Method on ArgumentMatcher

  * The ArgumentMatcher interface now includes a new type() method to support
    varargs methods, addressing previous limitations

  * Users can now differentiate between matching calls with any exact number of
    arguments or match any number of arguments
  * Mockito 5 provides a default implementation of the new method, ensuring
    backward compatibility.
  * No obligation for users to implement the new method; Mockito 5 considers
    Void.type by default for varargs handling
  * ArgumentCaptor is now fully type-aware, enabling capturing specific
    subclasses on a generic method.

  * byte-buddy does not bundle asm, but uses objectweb-asm as external library

snake-yaml was updated to version 2.2:

  * Changes of version 2.2:

  * Define default scalar style as PLAIN (for polyglot Maven)

  * Add missing 'exports org.yaml.snakeyaml.inspector' to module-info.java

  * Changes of version 2.1:

  * Heavy Allocation in Emitter.analyzeScalar(String) due to Regex Overhead

  * Use identity in toString() for sequences to avoid OutOfMemoryError
  * NumberFormatException from SnakeYAML due to int overflow for corrupt YAML
    version
  * Document size limit should be applied to single document notthe whole input
    stream
  * Detect invalid Unicode code point (thanks to Tatu Saloranta)
  * Remove Trusted*Inspector classes from main sources tree

  * Changes of version 2.0:

  * Rollback to Java 7 target

  * Add module-info.java
  * Migrate to Java 8
  * Remove many deprecated constructors
  * Remove long deprecated methods in FlowStyle
  * Do not allow global tags by default
  * Yaml.LoadAs() signature to support Class type instead of Class
  * CustomClassLoaderConstructor takes LoaderOptions
  * Check input parameters for non-null values

testng was updated to version 7.10.1:

  * Security issues fixed:

  * CVE-2022-4065: Fixed Zip Slip Vulnerability (bsc#1205628)

  * Changes of version 7.10.1:

  * Fixed maven build with junit5

  * Changes of version 7.10.0:

  * Minor discrepancy fixes

  * Deleting TestNG eclipse plugin specific classes
  * Remove deprecated JUnit related support in TestNG
  * Handle exceptions in emailable Reporter
  * Added wrapperbot and update workflow order
  * Support ITestNGFactory customisation
  * Streamlined data provider listener invocation
  * Streamlined Guice Module creation in concurrency.
  * Copy test result attributes when unexpected failures
  * chore: use explicit dependency versions instead of refreshVersions
  * Removed Ant
  * Support ordering of listeners
  * Added errorprone
  * Allow custom thread pool executors to be wired in.
  * Allow data providers to be non cacheable
  * Use Locks instead of synchronised keyword
  * Document pgp artifact signing keys
  * Added Unique Id for all test class instances
  * Added issue management workflows
  * Map object to configurations
  * Allow listeners to be disabled at runtime
  * Streamlined Data Provider execution
  * Honour inheritance when parsing listener factories
  * Tweaks around accessing SuiteResult
  * Streamlined random generation
  * Streamlined dependencies for configurations

  * Changes of version 7.9.0:

  * Fixed maps containing nulls can be incorrectly considered equal

  * Test Results as artifacts for failed runs
  * Fixed data races
  * Dont honour params specified in suite-file tag
  * Decouple SuiteRunner and TestRunner
  * Disable Native DI for BeforeSuite methods
  * Streamlined running Parallel Dataproviders+retries
  * Removed extra whitespace in log for Configuration.createMethods()
  * Added the link for TestNG Documentation's GitHub Repo in README.md
  * FirstTimeOnlyConfig methods + Listener invocations
  * Added overrideGroupsFromCliInParentChildXml test
  * Ensure thread safety for attribute access
  * Added @inherited to the Listeners annotation
  * Restrict Group inheritance to Before|AfterGroups
  * Ensure ITestResult injected to @AfterMethod is apt
  * Support suite level thread pools for data provider
  * Favour CompletableFuture instead of PoolService
  * Favour FutureTask for concurrency support
  * Shared Threadpool for normal/datadriven tests.
  * Abort for invalid combinations

  * Changes of version 7.8.0:

  * [Feature] Not exception but warning if some (not all) of the given test
    names are not found in suite files.

  * [Feature] Generate testng-results.xml per test suite
  * [Feature] Allow test classes to define "configfailurepolicy" at a per class
    level
  * XmlTest index is not set for test suites invoked with YAML
  * Listener's onAfterClass is called before @afterclass configuration methods
    are executed.
  * After upgrading to TestNG 7.5.0, setting ITestResult.status to FAILURE
    doesn't fail the test anymore
  * JUnitReportReporter should capture the test case output at the test case
    level
  * TestNG.xml doesn't honour Parallel value of a clone
  * before configuration and before invocation should be 'SKIP' when
    beforeMethod is 'skip'
  * Test listeners specified in parent testng.xml file are not included in
    testng-failed.xml file
  * Discrepancies with DataProvider and Retry of failed tests
  * Skipped Tests with DataProvider appear as failed
  * testng-results xml reports config skips from base classes as ignored
  * Feature: Check that specific object present in List
  * Upgraded snakeyaml to 2.0

  * Changes of version 7.7.1:

  * Streamline overloaded assertion methods for Groovy

  * Changes of version 7.7.0:

  * Replace FindBugs by SpotBugs

  * Gradle: Drop forUseAtConfigurationTime()
  * Added ability to provide custom message to assertThrows\expectThrows methods
  * Only resolve hostname once
  * Prevent overlogging of debug msgs in Graph impl
  * Streamlined dataprovider invoking in abstract classes
  * Streamlined TestResult due to expectedExceptions
  * Unexpected test runs count with retry analyzer
  * Make PackageUtils compliant with JPMS
  * Ability to retry a data provider during failures
  * Fixing bug with DataProvider retry
  * Added config key for callback discrepancy behavior
  * Fixed FileAlreadyExistsException error on copy
  * JarFileUtils.delete(File f) throw actual exception (instead of FileNotFound)
    when file cannot be deleted #2825
  * Changing assertion message of the osgitest
  * Enhancing the Matrix
  * Avoid Compilation errors on Semeru JDK flavour.
  * Add addition yml extension
  * Support getting dependencies info for a test
  * Honour regex in dependsOnMethods
  * Ensure All tests run all the time
  * Deprecate support for running Spock Tests
  * Streamline dependsOnMethods for configurations
  * Ensure ITestContext available for JUnit4 tests
  * Deprecate support for running JUnit tests
  * Changes of 7.6.1
  * Fix Files.copy() such that parent dirs are created
  * Remove deprecated utility methods

  * Changes of version 7.6.0:

  * Remove redundant Parameter implementation

  * Upgraded to JDK11
  * Move SimpleBaseTest to be Kotlin based
  * Restore testnames when using suites in suite.
  * Moving ClassHelperTests into Kotlin
  * IHookable and IConfigurable callback discrepancy
  * Minor refactoring
  * Add additional condition for assertEqualsNoOrder
  * beforeConfiguration() listener method should be invoked for skipped
    configurations as well
  * Keep the initial order of listeners
  * SuiteRunner could not be initial by default Configuration
  * Enable Dataprovider failures to be considered.
  * BeforeGroups should run before any matched test
  * Fixed possible StringIndexOutOfBoundsException exception in XmlReporter
  * DataProvider: possibility to unload dataprovider class, when done with it
  * Fixed possibilty that AfterGroups method is invoked before all tests
  * Fixed equals implementation for WrappedTestNGMethod
  * Wire-In listeners consistently
  * Streamline AfterClass invocation
  * Show FQMN for tests in console
  * Honour custom attribute values in TestNG default reports

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * openSUSE Leap 15.5  
    zypper in -t patch openSUSE-SLE-15.5-2024-2568=1

  * openSUSE Leap 15.6  
    zypper in -t patch openSUSE-SLE-15.6-2024-2568=1

  * Development Tools Module 15-SP5  
    zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-2568=1

  * Development Tools Module 15-SP6  
    zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP6-2024-2568=1

  * SUSE Package Hub 15 15-SP6  
    zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-2568=1

  * SUSE Manager Server 4.3 Module 4.3  
    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.3-2024-2568=1

  * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-2568=1

  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-2568=1

  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-2568=1

  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-2568=1

  * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4  
    zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-2568=1

  * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-2568=1

  * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-2568=1

  * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-2568=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP2  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-2568=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP3  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-2568=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP4  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-2568=1

  * SUSE Enterprise Storage 7.1  
    zypper in -t patch SUSE-Storage-7.1-2024-2568=1

## Package List:

  * openSUSE Leap 15.5 (noarch)
    * snakeyaml-2.2-150200.3.15.1
    * mockito-5.11.0-150200.3.7.1
    * mockito-javadoc-5.11.0-150200.3.7.1
    * snakeyaml-javadoc-2.2-150200.3.15.1
    * testng-javadoc-7.10.1-150200.3.10.1
    * testng-7.10.1-150200.3.10.1
  * openSUSE Leap 15.6 (noarch)
    * snakeyaml-2.2-150200.3.15.1
    * mockito-5.11.0-150200.3.7.1
    * mockito-javadoc-5.11.0-150200.3.7.1
    * snakeyaml-javadoc-2.2-150200.3.15.1
    * testng-javadoc-7.10.1-150200.3.10.1
    * testng-7.10.1-150200.3.10.1
  * Development Tools Module 15-SP5 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * Development Tools Module 15-SP6 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Package Hub 15 15-SP6 (noarch)
    * mockito-5.11.0-150200.3.7.1
  * SUSE Manager Server 4.3 Module 4.3 (noarch)
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1
  * SUSE Enterprise Storage 7.1 (noarch)
    * testng-7.10.1-150200.3.10.1
    * snakeyaml-2.2-150200.3.15.1

## References:

  * https://www.suse.com/security/cve/CVE-2022-4065.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1205628

Critical Security Advisory for Mockito, SnakeYAML, and TestNG in SUSE Updates

July 22, 2024
* bsc#1205628 Cross-References: * CVE-2022-4065

Summary

## This update for mockito, snakeyaml, testng fixes the following issues: mockito was updated to version 5.11.0: * Added bundle manifest to the mockito-core artifact * Mockito 5 is making core changes to ensure compatibility with future JDK versions. * Switch the Default MockMaker to mockito-inline (not applicable to mockito- android) * Mockito 2.7.6 introduced the mockito-inline mockmaker based on the "inline bytecode" principle, offering compatibility advantages over the subclass mockmaker * This change avoids JDK restrictions, such as violating module boundaries and leaking subclass creation * Legitimate use cases for the subclass mockmaker: * Scenarios where the inline mockmaker does not function, such as on Graal VM's native image * If avoiding mocking final classes, the subclass mockmaker remains a viable option, although issues may arise on JDK 17+ * Mockito aims to support both mockmakers, allowing users to choose based on ...

Read the Full Advisory

References

* bsc#1205628

Cross-

* CVE-2022-4065

CVSS scores:

* CVE-2022-4065 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2022-4065 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2022-4065 ( NVD ): 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Affected Products:

* Development Tools Module 15-SP5

* Development Tools Module 15-SP6

* openSUSE Leap 15.5

* openSUSE Leap 15.6

* SUSE Enterprise Storage 7.1

* SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4

* SUSE Linux Enterprise Desktop 15 SP5

* SUSE Linux Enterprise Desktop 15 SP6

* SUSE Linux Enterprise High Performance Computing 15 SP2

* SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2

* SUSE Linux Enterprise High Performance Computing 15 SP3

* SUSE Linux Enterprise High Performance Computing 15 SP4

* SUSE Linux Enterprise High Performance Computing 15 SP5

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4

* SUSE Linux Enterprise High Performance Co...

Read the Full Advisory

Severity
Announcement ID: SUSE-SU-2024:2568-1
Rating: important

Related News

The End of the Road for Linux 6.11: A Call to Upgrade to Kernel 6.12
3 - 5 min read
The Linux kernel community recently issued an EOL announcement regarding the 6.11 kernel series, urging sysadmins to upgrade quickly to 6.12 . This
A Linux Admin
3 - 6 min read
As 2025 approaches, we Linux admins are facing new and often unseen cloud-native security obstacles. While skilled at mitigating known risks,
Leveraging Insights from the Linux Foundation
3 - 5 min read
The Linux Foundation's recent Census III report provides critical insights for Linux administrators, information security professionals, and anyone
Chrome 131 Released: Emergency Security Update Fixes Over a Dozen Significant Vulns
3 - 6 min read
Google recently unveiled a critical security update to their popular web browser, Google Chrome, addressing over a dozen significant security
From Wayland Fixes to Security Boosts: Examining Qt 6.8.1
3 - 6 min read
The recent Qt 6.8.1 release brings significant updates and improvements, strengthening its reputation as a secure and reliable application
Exploring Arch Linux 2024.12.01: Security Implications & Notable Enhancements for Linux Admins
3 - 6 min read
The Arch Linux 2024.12.01 ISO release marks an impressive milestone, offering cutting-edge updates that enhance functionality, streamline
Deck the Halls with Enhanced Security: Linux Kernel 6.13
3 - 5 min read
As Linux admins and infosec professionals prepare for the holiday season, there's much cause for celebration this year! Linus Torvalds recently made
Lessons from Bootkitty: Securing Linux Systems Against UEFI Intrusions
3 - 5 min read
New Linux security threats mark critical junctures that challenge existing policies and test security protocols to their limit. One such milestone

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved