Upgrade gson to 2.8.9 (#1018)

Fixes CVE-2022-25647
awslabs · Jun 1, 2023 · 2b89300 · 2b89300
1 parent c340440
commit 2b89300
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 6 deletions.
diff --git a/frontend/gradle.properties b/frontend/gradle.properties
@@ -3,7 +3,7 @@ org.gradle.jvmargs=-Xmx1024M
 netty_version=4.1.91.Final
 slf4j_api_version=1.7.32
 slf4j_log4j_version=2.17.1
-gson_version=2.8.5
+gson_version=2.8.9
 commons_cli_version=1.3.1
 testng_version=6.8.1
 mms_server_sdk_version=1.0.1

diff --git a/frontend/modelarchive/src/main/java/com/amazonaws/ml/mms/archive/ModelArchive.java b/frontend/modelarchive/src/main/java/com/amazonaws/ml/mms/archive/ModelArchive.java
@@ -108,8 +108,7 @@ public static void migrate(File legacyModelFile, File destination)
             InputStream is = zip.getInputStream(manifestEntry);
             Reader reader = new InputStreamReader(is, StandardCharsets.UTF_8);
 
-            JsonParser parser = new JsonParser();
-            JsonObject json = (JsonObject) parser.parse(reader);
+            JsonObject json = JsonParser.parseReader(reader).getAsJsonObject();
             JsonPrimitive version = json.getAsJsonPrimitive("specificationVersion");
             Manifest manifest;
             if (version != null && "1.0".equals(version.getAsString())) {

diff --git a/mms/version.py b/mms/version.py
@@ -11,4 +11,4 @@
 This is the current version of MMS
 """
 
-__version__ = '1.1.9'
+__version__ = '1.1.10'
diff --git a/plugins/gradle.properties b/plugins/gradle.properties
@@ -1,2 +1,2 @@
-gson_version=2.8.5
-mms_server_sdk_version=1.0.1
+gson_version=2.8.9
+mms_server_sdk_version=1.0.1