From bea471aad264d3ee4825f20961e4c230c026cdf0 Mon Sep 17 00:00:00 2001 From: Rundeck CI Date: Mon, 13 Jul 2026 13:20:14 -0700 Subject: [PATCH] Update Bouncy Castle from 1.79 to 1.84 Updates Bouncy Castle dependency to address additional security vulnerabilities beyond CVE-2025-8916, including CVE-2026-0636 (LDAP injection), CVE-2026-3505 (PGP AEAD resource exhaustion), CVE-2026-5588 (PKIX signature validation), and CVE-2026-5598 (FrodoKEM key leakage). This update only affects build-time RPM package signing and does not impact runtime application functionality. --- buildSrc/build.gradle | 2 +- buildSrc/gradle.properties | 2 +- gradle.properties | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle index c026e03..b75933a 100644 --- a/buildSrc/build.gradle +++ b/buildSrc/build.gradle @@ -8,7 +8,7 @@ repositories { // Mitigate CVE-2024-25710: Force commons-compress to 1.26.2 // SNYK-JAVA-ORGAPACHECOMMONS-10734078 (CVE-2025-48924): commons-lang3 requires 3.18.0+ -// Mitigate CVE-2025-8916: Force Bouncy Castle dependencies to 1.79 +// Mitigate CVE-2025-8916 and additional CVEs: Force Bouncy Castle dependencies to 1.84 configurations.all { resolutionStrategy { force "org.apache.commons:commons-compress:${commonsCompressVersion}" diff --git a/buildSrc/gradle.properties b/buildSrc/gradle.properties index 8fc1588..9f0d60b 100644 --- a/buildSrc/gradle.properties +++ b/buildSrc/gradle.properties @@ -1,3 +1,3 @@ commonsCompressVersion=1.26.2 commonsLang3Version=3.20.0 -bouncyCastleVersion=1.79 +bouncyCastleVersion=1.84 diff --git a/gradle.properties b/gradle.properties index 8fc1588..9f0d60b 100644 --- a/gradle.properties +++ b/gradle.properties @@ -1,3 +1,3 @@ commonsCompressVersion=1.26.2 commonsLang3Version=3.20.0 -bouncyCastleVersion=1.79 +bouncyCastleVersion=1.84