csaf_suse - suse-su-2024:2568-1

suse-su-2024:2568-1

Vulnerability from csaf_suse

Published

2024-07-22 03:19

Modified

2024-07-22 03:19

Summary

Security update for mockito, snakeyaml, testng

Notes

Title of the patch

Security update for mockito, snakeyaml, testng

Description of the patch

This update for mockito, snakeyaml, testng fixes the following issues: mockito was updated to version 5.11.0: - Added bundle manifest to the mockito-core artifact - Mockito 5 is making core changes to ensure compatibility with future JDK versions. - Switch the Default MockMaker to mockito-inline (not applicable to mockito-android) * Mockito 2.7.6 introduced the mockito-inline mockmaker based on the 'inline bytecode' principle, offering compatibility advantages over the subclass mockmaker * This change avoids JDK restrictions, such as violating module boundaries and leaking subclass creation - Legitimate use cases for the subclass mockmaker: * Scenarios where the inline mockmaker does not function, such as on Graal VM's native image * If avoiding mocking final classes, the subclass mockmaker remains a viable option, although issues may arise on JDK 17+ * Mockito aims to support both mockmakers, allowing users to choose based on their requirements. - Update the Minimum Supported Java Version to 11 * Mockito 5 raised the minimum supported Java version to 11 * Community member @reta contributed to this change. * Users still on JDK 8 can continue using Mockito 4, with minimal API differences between versions - New type() Method on ArgumentMatcher * The ArgumentMatcher interface now includes a new type() method to support varargs methods, addressing previous limitations * Users can now differentiate between matching calls with any exact number of arguments or match any number of arguments * Mockito 5 provides a default implementation of the new method, ensuring backward compatibility. * No obligation for users to implement the new method; Mockito 5 considers Void.type by default for varargs handling * ArgumentCaptor is now fully type-aware, enabling capturing specific subclasses on a generic method. - byte-buddy does not bundle asm, but uses objectweb-asm as external library snake-yaml was updated to version 2.2: - Changes of version 2.2: * Define default scalar style as PLAIN (for polyglot Maven) * Add missing 'exports org.yaml.snakeyaml.inspector' to module-info.java - Changes of version 2.1: * Heavy Allocation in Emitter.analyzeScalar(String) due to Regex Overhead * Use identity in toString() for sequences to avoid OutOfMemoryError * NumberFormatException from SnakeYAML due to int overflow for corrupt YAML version * Document size limit should be applied to single document notthe whole input stream * Detect invalid Unicode code point (thanks to Tatu Saloranta) * Remove Trusted*Inspector classes from main sources tree - Changes of version 2.0: * Rollback to Java 7 target * Add module-info.java * Migrate to Java 8 * Remove many deprecated constructors * Remove long deprecated methods in FlowStyle * Do not allow global tags by default * Yaml.LoadAs() signature to support Class<? super T> type instead of Class<T> * CustomClassLoaderConstructor takes LoaderOptions * Check input parameters for non-null values testng was updated to version 7.10.1: - Security issues fixed: * CVE-2022-4065: Fixed Zip Slip Vulnerability (bsc#1205628) - Changes of version 7.10.1: * Fixed maven build with junit5 - Changes of version 7.10.0: * Minor discrepancy fixes * Deleting TestNG eclipse plugin specific classes * Remove deprecated JUnit related support in TestNG * Handle exceptions in emailable Reporter * Added wrapperbot and update workflow order * Support ITestNGFactory customisation * Streamlined data provider listener invocation * Streamlined Guice Module creation in concurrency. * Copy test result attributes when unexpected failures * chore: use explicit dependency versions instead of refreshVersions * Removed Ant * Support ordering of listeners * Added errorprone * Allow custom thread pool executors to be wired in. * Allow data providers to be non cacheable * Use Locks instead of synchronised keyword * Document pgp artifact signing keys * Added Unique Id for all test class instances * Added issue management workflows * Map object to configurations * Allow listeners to be disabled at runtime * Streamlined Data Provider execution * Honour inheritance when parsing listener factories * Tweaks around accessing SuiteResult * Streamlined random generation * Streamlined dependencies for configurations - Changes of version 7.9.0: * Fixed maps containing nulls can be incorrectly considered equal * Test Results as artifacts for failed runs * Fixed data races * Dont honour params specified in suite-file tag * Decouple SuiteRunner and TestRunner * Disable Native DI for BeforeSuite methods * Streamlined running Parallel Dataproviders+retries * Removed extra whitespace in log for Configuration.createMethods() * Added the link for TestNG Documentation's GitHub Repo in README.md * FirstTimeOnlyConfig methods + Listener invocations * Added overrideGroupsFromCliInParentChildXml test * Ensure thread safety for attribute access * Added @inherited to the Listeners annotation * Restrict Group inheritance to Before|AfterGroups * Ensure ITestResult injected to @AfterMethod is apt * Support suite level thread pools for data provider * Favour CompletableFuture instead of PoolService * Favour FutureTask for concurrency support * Shared Threadpool for normal/datadriven tests. * Abort for invalid combinations - Changes of version 7.8.0: * [Feature] Not exception but warning if some (not all) of the given test names are not found in suite files. * [Feature] Generate testng-results.xml per test suite * [Feature] Allow test classes to define 'configfailurepolicy' at a per class level * XmlTest index is not set for test suites invoked with YAML * Listener's onAfterClass is called before @afterclass configuration methods are executed. * After upgrading to TestNG 7.5.0, setting ITestResult.status to FAILURE doesn't fail the test anymore * JUnitReportReporter should capture the test case output at the test case level * TestNG.xml doesn't honour Parallel value of a clone * before configuration and before invocation should be 'SKIP' when beforeMethod is 'skip' * Test listeners specified in parent testng.xml file are not included in testng-failed.xml file * Discrepancies with DataProvider and Retry of failed tests * Skipped Tests with DataProvider appear as failed * testng-results xml reports config skips from base classes as ignored * Feature: Check that specific object present in List * Upgraded snakeyaml to 2.0 - Changes of version 7.7.1: * Streamline overloaded assertion methods for Groovy - Changes of version 7.7.0: * Replace FindBugs by SpotBugs * Gradle: Drop forUseAtConfigurationTime() * Added ability to provide custom message to assertThrows\expectThrows methods * Only resolve hostname once * Prevent overlogging of debug msgs in Graph impl * Streamlined dataprovider invoking in abstract classes * Streamlined TestResult due to expectedExceptions * Unexpected test runs count with retry analyzer * Make PackageUtils compliant with JPMS * Ability to retry a data provider during failures * Fixing bug with DataProvider retry * Added config key for callback discrepancy behavior * Fixed FileAlreadyExistsException error on copy * JarFileUtils.delete(File f) throw actual exception (instead of FileNotFound) when file cannot be deleted #2825 * Changing assertion message of the osgitest * Enhancing the Matrix * Avoid Compilation errors on Semeru JDK flavour. * Add addition yml extension * Support getting dependencies info for a test * Honour regex in dependsOnMethods * Ensure All tests run all the time * Deprecate support for running Spock Tests * Streamline dependsOnMethods for configurations * Ensure ITestContext available for JUnit4 tests * Deprecate support for running JUnit tests * Changes of 7.6.1 * Fix Files.copy() such that parent dirs are created * Remove deprecated utility methods - Changes of version 7.6.0: * Remove redundant Parameter implementation * Upgraded to JDK11 * Move SimpleBaseTest to be Kotlin based * Restore testnames when using suites in suite. * Moving ClassHelperTests into Kotlin * IHookable and IConfigurable callback discrepancy * Minor refactoring * Add additional condition for assertEqualsNoOrder * beforeConfiguration() listener method should be invoked for skipped configurations as well * Keep the initial order of listeners * SuiteRunner could not be initial by default Configuration * Enable Dataprovider failures to be considered. * BeforeGroups should run before any matched test * Fixed possible StringIndexOutOfBoundsException exception in XmlReporter * DataProvider: possibility to unload dataprovider class, when done with it * Fixed possibilty that AfterGroups method is invoked before all tests * Fixed equals implementation for WrappedTestNGMethod * Wire-In listeners consistently * Streamline AfterClass invocation * Show FQMN for tests in console * Honour custom attribute values in TestNG default reports

Patchnames

SUSE-2024-2568,SUSE-SLE-Module-Development-Tools-15-SP5-2024-2568,SUSE-SLE-Module-Development-Tools-15-SP6-2024-2568,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-2568,SUSE-SLE-Module-SUSE-Manager-Server-4.3-2024-2568,SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-2568,SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-2568,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-2568,SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-2568,SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-2568,SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-2568,SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-2568,SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-2568,SUSE-SLE-Product-SLES_SAP-15-SP2-2024-2568,SUSE-SLE-Product-SLES_SAP-15-SP3-2024-2568,SUSE-SLE-Product-SLES_SAP-15-SP4-2024-2568,SUSE-Storage-7.1-2024-2568,openSUSE-SLE-15.5-2024-2568,openSUSE-SLE-15.6-2024-2568

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for mockito, snakeyaml, testng",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for mockito, snakeyaml, testng fixes the following issues:\n\nmockito was updated to version 5.11.0:\n\n- Added bundle manifest to the mockito-core artifact\n- Mockito 5 is making core changes to ensure compatibility with future JDK versions.\n- Switch the Default MockMaker to mockito-inline (not applicable to mockito-android)\n\n  * Mockito 2.7.6 introduced the mockito-inline mockmaker based on the \u0027inline bytecode\u0027 principle, offering\n    compatibility advantages over the subclass mockmaker\n  * This change avoids JDK restrictions, such as violating module boundaries and leaking subclass creation\n\n- Legitimate use cases for the subclass mockmaker:\n\n  * Scenarios where the inline mockmaker does not function, such as on Graal VM\u0027s native image\n  * If avoiding mocking final classes, the subclass mockmaker remains a viable option, although issues may arise on\n    JDK 17+\n  * Mockito aims to support both mockmakers, allowing users to choose based on their requirements.\n\n- Update the Minimum Supported Java Version to 11\n\n  * Mockito 5 raised the minimum supported Java version to 11\n  * Community member @reta contributed to this change.\n  * Users still on JDK 8 can continue using Mockito 4, with minimal API differences between versions\n\n- New type() Method on ArgumentMatcher\n\n  * The ArgumentMatcher interface now includes a new type() method to support varargs methods, addressing previous\n    limitations\n  * Users can now differentiate between matching calls with any exact number of arguments or match any number of\n    arguments\n  * Mockito 5 provides a default implementation of the new method, ensuring backward compatibility.\n  * No obligation for users to implement the new method; Mockito 5 considers Void.type by default for varargs handling\n  * ArgumentCaptor is now fully type-aware, enabling capturing specific subclasses on a generic method.\n\n- byte-buddy does not bundle asm, but uses objectweb-asm as external library\n\nsnake-yaml was updated to version 2.2:\n\n- Changes of version 2.2:\n\n  * Define default scalar style as PLAIN (for polyglot Maven)\n  * Add missing \u0027exports org.yaml.snakeyaml.inspector\u0027 to module-info.java\n\n- Changes of version 2.1:\n\n  * Heavy Allocation in Emitter.analyzeScalar(String) due to Regex Overhead\n  * Use identity in toString() for sequences to avoid OutOfMemoryError\n  * NumberFormatException from SnakeYAML due to int overflow for corrupt YAML version\n  * Document size limit should be applied to single document notthe whole input stream\n  * Detect invalid Unicode code point (thanks to Tatu Saloranta)\n  * Remove Trusted*Inspector classes from main sources tree\n\n- Changes of version 2.0:\n\n  * Rollback to Java 7 target\n  * Add module-info.java\n  * Migrate to Java 8\n  * Remove many deprecated constructors\n  * Remove long deprecated methods in FlowStyle\n  * Do not allow global tags by default\n  * Yaml.LoadAs() signature to support Class\u003c? super T\u003e type instead of Class\u003cT\u003e\n  * CustomClassLoaderConstructor takes LoaderOptions\n  * Check input parameters for non-null values\n\ntestng was updated to version 7.10.1:\n\n- Security issues fixed:\n\n  * CVE-2022-4065: Fixed Zip Slip Vulnerability (bsc#1205628)\n\n- Changes of version 7.10.1:\n\n  * Fixed maven build with junit5\n\n- Changes of version 7.10.0:\n\n  * Minor discrepancy fixes\n  * Deleting TestNG eclipse plugin specific classes\n  * Remove deprecated JUnit related support in TestNG\n  * Handle exceptions in emailable Reporter\n  * Added wrapperbot and update workflow order\n  * Support ITestNGFactory customisation\n  * Streamlined data provider listener invocation\n  * Streamlined Guice Module creation in concurrency.\n  * Copy test result attributes when unexpected failures\n  * chore: use explicit dependency versions instead of refreshVersions\n  * Removed Ant\n  * Support ordering of listeners\n  * Added errorprone\n  * Allow custom thread pool executors to be wired in.\n  * Allow data providers to be non cacheable\n  * Use Locks instead of synchronised keyword\n  * Document pgp artifact signing keys\n  * Added Unique Id for all test class instances\n  * Added issue management workflows\n  * Map object to configurations\n  * Allow listeners to be disabled at runtime\n  * Streamlined Data Provider execution\n  * Honour inheritance when parsing listener factories\n  * Tweaks around accessing SuiteResult\n  * Streamlined random generation\n  * Streamlined dependencies for configurations\n\n- Changes of version 7.9.0:\n\n  * Fixed maps containing nulls can be incorrectly considered equal\n  * Test Results as artifacts for failed runs\n  * Fixed data races\n  * Dont honour params specified in suite-file tag\n  * Decouple SuiteRunner and TestRunner\n  * Disable Native DI for BeforeSuite methods\n  * Streamlined running Parallel Dataproviders+retries\n  * Removed extra whitespace in log for Configuration.createMethods()\n  * Added the link for TestNG Documentation\u0027s GitHub Repo in README.md\n  * FirstTimeOnlyConfig methods + Listener invocations\n  * Added overrideGroupsFromCliInParentChildXml test\n  * Ensure thread safety for attribute access\n  * Added @inherited to the Listeners annotation\n  * Restrict Group inheritance to Before|AfterGroups\n  * Ensure ITestResult injected to @AfterMethod is apt\n  * Support suite level thread pools for data provider\n  * Favour CompletableFuture instead of PoolService\n  * Favour FutureTask for concurrency support\n  * Shared Threadpool for normal/datadriven tests.\n  * Abort for invalid combinations\n\n- Changes of version 7.8.0:\n\n  * [Feature] Not exception but warning if some (not all) of the given test names are not found in suite files.\n  * [Feature] Generate testng-results.xml per test suite\n  * [Feature] Allow test classes to define \u0027configfailurepolicy\u0027 at a per class level\n  * XmlTest index is not set for test suites invoked with YAML\n  * Listener\u0027s onAfterClass is called before @afterclass configuration methods are executed.\n  * After upgrading to TestNG 7.5.0, setting ITestResult.status to FAILURE doesn\u0027t fail the test anymore\n  * JUnitReportReporter should capture the test case output at the test case level\n  * TestNG.xml doesn\u0027t honour Parallel value of a clone\n  * before configuration and before invocation should be \u0027SKIP\u0027 when beforeMethod is \u0027skip\u0027\n  * Test listeners specified in parent testng.xml file are not included in testng-failed.xml file\n  * Discrepancies with DataProvider and Retry of failed tests\n  * Skipped Tests with DataProvider appear as failed\n  * testng-results xml reports config skips from base classes as ignored\n  * Feature: Check that specific object present in List\n  * Upgraded snakeyaml to 2.0\n\n- Changes of version 7.7.1:\n\n  * Streamline overloaded assertion methods for Groovy\n\n- Changes of version 7.7.0:\n\n  * Replace FindBugs by SpotBugs\n  * Gradle: Drop forUseAtConfigurationTime()\n  * Added ability to provide custom message to assertThrows\\expectThrows methods\n  * Only resolve hostname once\n  * Prevent overlogging of debug msgs in Graph impl\n  * Streamlined dataprovider invoking in abstract classes\n  * Streamlined TestResult due to expectedExceptions\n  * Unexpected test runs count with retry analyzer\n  * Make PackageUtils compliant with JPMS\n  * Ability to retry a data provider during failures\n  * Fixing bug with DataProvider retry\n  * Added config key for callback discrepancy behavior\n  * Fixed FileAlreadyExistsException error on copy\n  * JarFileUtils.delete(File f) throw actual exception (instead of FileNotFound) when file cannot be deleted #2825\n  * Changing assertion message of the osgitest\n  * Enhancing the Matrix\n  * Avoid Compilation errors on Semeru JDK flavour.\n  * Add addition yml extension\n  * Support getting dependencies info for a test\n  * Honour regex in dependsOnMethods\n  * Ensure All tests run all the time\n  * Deprecate support for running Spock Tests\n  * Streamline dependsOnMethods for configurations\n  * Ensure ITestContext available for JUnit4 tests\n  * Deprecate support for running JUnit tests\n  * Changes of 7.6.1\n  * Fix Files.copy() such that parent dirs are created\n  * Remove deprecated utility methods\n\n- Changes of version 7.6.0:\n\n  * Remove redundant Parameter implementation\n  * Upgraded to JDK11\n  * Move SimpleBaseTest to be Kotlin based\n  * Restore testnames when using suites in suite.\n  * Moving ClassHelperTests into Kotlin\n  * IHookable and IConfigurable callback discrepancy\n  * Minor refactoring\n  * Add additional condition for assertEqualsNoOrder\n  * beforeConfiguration() listener method should be invoked for skipped configurations as well\n  * Keep the initial order of listeners\n  * SuiteRunner could not be initial by default Configuration\n  * Enable Dataprovider failures to be considered.\n  * BeforeGroups should run before any matched test\n  * Fixed possible StringIndexOutOfBoundsException exception in XmlReporter\n  * DataProvider: possibility to unload dataprovider class, when done with it\n  * Fixed possibilty that AfterGroups method is invoked before all tests\n  * Fixed equals implementation for WrappedTestNGMethod\n  * Wire-In listeners consistently\n  * Streamline AfterClass invocation\n  * Show FQMN for tests in console\n  * Honour custom attribute values in TestNG default reports\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2024-2568,SUSE-SLE-Module-Development-Tools-15-SP5-2024-2568,SUSE-SLE-Module-Development-Tools-15-SP6-2024-2568,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-2568,SUSE-SLE-Module-SUSE-Manager-Server-4.3-2024-2568,SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-2568,SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-2568,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-2568,SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-2568,SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-2568,SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-2568,SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-2568,SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-2568,SUSE-SLE-Product-SLES_SAP-15-SP2-2024-2568,SUSE-SLE-Product-SLES_SAP-15-SP3-2024-2568,SUSE-SLE-Product-SLES_SAP-15-SP4-2024-2568,SUSE-Storage-7.1-2024-2568,openSUSE-SLE-15.5-2024-2568,openSUSE-SLE-15.6-2024-2568",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_2568-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2024:2568-1",
        "url": "https://www.suse.com/support/update/announcement/2024/suse-su-20242568-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2024:2568-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-July/019004.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1205628",
        "url": "https://bugzilla.suse.com/1205628"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-4065 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-4065/"
      }
    ],
    "title": "Security update for mockito, snakeyaml, testng",
    "tracking": {
      "current_release_date": "2024-07-22T03:19:30Z",
      "generator": {
        "date": "2024-07-22T03:19:30Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2024:2568-1",
      "initial_release_date": "2024-07-22T03:19:30Z",
      "revision_history": [
        {
          "date": "2024-07-22T03:19:30Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mockito-5.11.0-150200.3.7.1.noarch",
                "product": {
                  "name": "mockito-5.11.0-150200.3.7.1.noarch",
                  "product_id": "mockito-5.11.0-150200.3.7.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "mockito-javadoc-5.11.0-150200.3.7.1.noarch",
                "product": {
                  "name": "mockito-javadoc-5.11.0-150200.3.7.1.noarch",
                  "product_id": "mockito-javadoc-5.11.0-150200.3.7.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "mockito-junit-jupiter-5.11.0-150200.3.7.1.noarch",
                "product": {
                  "name": "mockito-junit-jupiter-5.11.0-150200.3.7.1.noarch",
                  "product_id": "mockito-junit-jupiter-5.11.0-150200.3.7.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "snakeyaml-2.2-150200.3.15.1.noarch",
                "product": {
                  "name": "snakeyaml-2.2-150200.3.15.1.noarch",
                  "product_id": "snakeyaml-2.2-150200.3.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "snakeyaml-javadoc-2.2-150200.3.15.1.noarch",
                "product": {
                  "name": "snakeyaml-javadoc-2.2-150200.3.15.1.noarch",
                  "product_id": "snakeyaml-javadoc-2.2-150200.3.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "testng-7.10.1-150200.3.10.1.noarch",
                "product": {
                  "name": "testng-7.10.1-150200.3.10.1.noarch",
                  "product_id": "testng-7.10.1-150200.3.10.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "testng-javadoc-7.10.1-150200.3.10.1.noarch",
                "product": {
                  "name": "testng-javadoc-7.10.1-150200.3.10.1.noarch",
                  "product_id": "testng-javadoc-7.10.1-150200.3.10.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Development Tools 15 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Development Tools 15 SP5",
                  "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-development-tools:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Development Tools 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Development Tools 15 SP6",
                  "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-development-tools:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
                  "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Server Module 4.3",
                "product": {
                  "name": "SUSE Manager Server Module 4.3",
                  "product_id": "SUSE Manager Server Module 4.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-suse-manager-server:4.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 7.1",
                "product": {
                  "name": "SUSE Enterprise Storage 7.1",
                  "product_id": "SUSE Enterprise Storage 7.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:7.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.5",
                "product": {
                  "name": "openSUSE Leap 15.5",
                  "product_id": "openSUSE Leap 15.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP5:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP5:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP6:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP6:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mockito-5.11.0-150200.3.7.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:mockito-5.11.0-150200.3.7.1.noarch"
        },
        "product_reference": "mockito-5.11.0-150200.3.7.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Manager Server Module 4.3",
          "product_id": "SUSE Manager Server Module 4.3:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Manager Server Module 4.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mockito-5.11.0-150200.3.7.1.noarch as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:mockito-5.11.0-150200.3.7.1.noarch"
        },
        "product_reference": "mockito-5.11.0-150200.3.7.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mockito-javadoc-5.11.0-150200.3.7.1.noarch as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:mockito-javadoc-5.11.0-150200.3.7.1.noarch"
        },
        "product_reference": "mockito-javadoc-5.11.0-150200.3.7.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-javadoc-2.2-150200.3.15.1.noarch as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:snakeyaml-javadoc-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-javadoc-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-javadoc-7.10.1-150200.3.10.1.noarch as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:testng-javadoc-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-javadoc-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mockito-5.11.0-150200.3.7.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:mockito-5.11.0-150200.3.7.1.noarch"
        },
        "product_reference": "mockito-5.11.0-150200.3.7.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mockito-javadoc-5.11.0-150200.3.7.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:mockito-javadoc-5.11.0-150200.3.7.1.noarch"
        },
        "product_reference": "mockito-javadoc-5.11.0-150200.3.7.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-2.2-150200.3.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:snakeyaml-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "snakeyaml-javadoc-2.2-150200.3.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:snakeyaml-javadoc-2.2-150200.3.15.1.noarch"
        },
        "product_reference": "snakeyaml-javadoc-2.2-150200.3.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-7.10.1-150200.3.10.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:testng-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "testng-javadoc-7.10.1-150200.3.10.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:testng-javadoc-7.10.1-150200.3.10.1.noarch"
        },
        "product_reference": "testng-javadoc-7.10.1-150200.3.10.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4065",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-4065"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7.1:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Enterprise Storage 7.1:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP5:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP6:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP6:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:mockito-5.11.0-150200.3.7.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:snakeyaml-2.2-150200.3.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:testng-7.10.1-150200.3.10.1.noarch",
          "SUSE Manager Server Module 4.3:snakeyaml-2.2-150200.3.15.1.noarch",
          "openSUSE Leap 15.5:mockito-5.11.0-150200.3.7.1.noarch",
          "openSUSE Leap 15.5:mockito-javadoc-5.11.0-150200.3.7.1.noarch",
          "openSUSE Leap 15.5:snakeyaml-2.2-150200.3.15.1.noarch",
          "openSUSE Leap 15.5:snakeyaml-javadoc-2.2-150200.3.15.1.noarch",
          "openSUSE Leap 15.5:testng-7.10.1-150200.3.10.1.noarch",
          "openSUSE Leap 15.5:testng-javadoc-7.10.1-150200.3.10.1.noarch",
          "openSUSE Leap 15.6:mockito-5.11.0-150200.3.7.1.noarch",
          "openSUSE Leap 15.6:mockito-javadoc-5.11.0-150200.3.7.1.noarch",
          "openSUSE Leap 15.6:snakeyaml-2.2-150200.3.15.1.noarch",
          "openSUSE Leap 15.6:snakeyaml-javadoc-2.2-150200.3.15.1.noarch",
          "openSUSE Leap 15.6:testng-7.10.1-150200.3.10.1.noarch",
          "openSUSE Leap 15.6:testng-javadoc-7.10.1-150200.3.10.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-4065",
          "url": "https://www.suse.com/security/cve/CVE-2022-4065"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1205628 for CVE-2022-4065",
          "url": "https://bugzilla.suse.com/1205628"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7.1:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Enterprise Storage 7.1:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP6:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP6:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:mockito-5.11.0-150200.3.7.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Manager Server Module 4.3:snakeyaml-2.2-150200.3.15.1.noarch",
            "openSUSE Leap 15.5:mockito-5.11.0-150200.3.7.1.noarch",
            "openSUSE Leap 15.5:mockito-javadoc-5.11.0-150200.3.7.1.noarch",
            "openSUSE Leap 15.5:snakeyaml-2.2-150200.3.15.1.noarch",
            "openSUSE Leap 15.5:snakeyaml-javadoc-2.2-150200.3.15.1.noarch",
            "openSUSE Leap 15.5:testng-7.10.1-150200.3.10.1.noarch",
            "openSUSE Leap 15.5:testng-javadoc-7.10.1-150200.3.10.1.noarch",
            "openSUSE Leap 15.6:mockito-5.11.0-150200.3.7.1.noarch",
            "openSUSE Leap 15.6:mockito-javadoc-5.11.0-150200.3.7.1.noarch",
            "openSUSE Leap 15.6:snakeyaml-2.2-150200.3.15.1.noarch",
            "openSUSE Leap 15.6:snakeyaml-javadoc-2.2-150200.3.15.1.noarch",
            "openSUSE Leap 15.6:testng-7.10.1-150200.3.10.1.noarch",
            "openSUSE Leap 15.6:testng-javadoc-7.10.1-150200.3.10.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7.1:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Enterprise Storage 7.1:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP5:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP6:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP6:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:mockito-5.11.0-150200.3.7.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:snakeyaml-2.2-150200.3.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:testng-7.10.1-150200.3.10.1.noarch",
            "SUSE Manager Server Module 4.3:snakeyaml-2.2-150200.3.15.1.noarch",
            "openSUSE Leap 15.5:mockito-5.11.0-150200.3.7.1.noarch",
            "openSUSE Leap 15.5:mockito-javadoc-5.11.0-150200.3.7.1.noarch",
            "openSUSE Leap 15.5:snakeyaml-2.2-150200.3.15.1.noarch",
            "openSUSE Leap 15.5:snakeyaml-javadoc-2.2-150200.3.15.1.noarch",
            "openSUSE Leap 15.5:testng-7.10.1-150200.3.10.1.noarch",
            "openSUSE Leap 15.5:testng-javadoc-7.10.1-150200.3.10.1.noarch",
            "openSUSE Leap 15.6:mockito-5.11.0-150200.3.7.1.noarch",
            "openSUSE Leap 15.6:mockito-javadoc-5.11.0-150200.3.7.1.noarch",
            "openSUSE Leap 15.6:snakeyaml-2.2-150200.3.15.1.noarch",
            "openSUSE Leap 15.6:snakeyaml-javadoc-2.2-150200.3.15.1.noarch",
            "openSUSE Leap 15.6:testng-7.10.1-150200.3.10.1.noarch",
            "openSUSE Leap 15.6:testng-javadoc-7.10.1-150200.3.10.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-07-22T03:19:30Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-4065"
    }
  ]
}

CVE-2022-4065 (GCVE-0-2022-4065)

Vulnerability from cvelistv5

Published

2022-11-19 00:00

Modified

2024-08-03 01:27

Severity ?

5.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
5.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

CWE

CWE-22 - Path Traversal

Summary

A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027.

References

▼	URL	Tags
	https://vuldb.com/?id.214027	vdb-entry, technical-description
	https://vuldb.com/?ctiid.214027	signature, permissions-required
	https://github.com/cbeust/testng/pull/2806	issue-tracking
	https://github.com/cbeust/testng/commit/9150736cd2c123a6a3b60e6193630859f9f0422b	patch
	https://github.com/cbeust/testng/releases/tag/7.7.1	patch

Impacted products

	Vendor	Product	Version
	cbeust	testng	Version: 7.5.0 Version: 7.6.0 Version: 7.6.1 Version: 7.7.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:27:54.473Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.214027"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.214027"
          },
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://github.com/cbeust/testng/pull/2806"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/cbeust/testng/commit/9150736cd2c123a6a3b60e6193630859f9f0422b"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/cbeust/testng/releases/tag/7.7.1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "XML File Parser"
          ],
          "product": "testng",
          "vendor": "cbeust",
          "versions": [
            {
              "status": "affected",
              "version": "7.5.0"
            },
            {
              "status": "affected",
              "version": "7.6.0"
            },
            {
              "status": "affected",
              "version": "7.6.1"
            },
            {
              "status": "affected",
              "version": "7.7.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "VulDB GitHub Commit Analyzer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027."
        },
        {
          "lang": "de",
          "value": "In cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0 wurde eine kritische Schwachstelle ausgemacht. Betroffen ist die Funktion testngXmlExistsInJar der Datei testng-core/src/main/java/org/testng/JarFileUtils.java der Komponente XML File Parser. Dank der Manipulation mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 7.5.1 and 7.7.1 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 9150736cd2c123a6a3b60e6193630859f9f0422b bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-20T14:06:22.348Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.214027"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.214027"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/cbeust/testng/pull/2806"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/cbeust/testng/commit/9150736cd2c123a6a3b60e6193630859f9f0422b"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/cbeust/testng/releases/tag/7.7.1"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2022-11-19T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2022-11-19T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2022-11-19T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-04-29T08:26:05.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "cbeust testng XML File Parser JarFileUtils.java testngXmlExistsInJar path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2022-4065",
    "datePublished": "2022-11-19T00:00:00",
    "dateReserved": "2022-11-19T00:00:00",
    "dateUpdated": "2024-08-03T01:27:54.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted