[fix][sec] Upgrade bouncycastle bcpkix-fips version to 1.79 to address CVE-2025-8916 #24650
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
e410715 to
99ecb7d
Compare
nodece
approved these changes
Aug 20, 2025
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #24650 +/- ##
============================================
- Coverage 74.32% 74.32% -0.01%
+ Complexity 33180 33177 -3
============================================
Files 1882 1882
Lines 146855 146855
Branches 16867 16867
============================================
- Hits 109152 109145 -7
Misses 29038 29038
- Partials 8665 8672 +7
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
merlimat
pushed a commit
that referenced
this pull request
Aug 21, 2025
lhotari
added a commit
that referenced
this pull request
Aug 26, 2025
…CVE-2025-8916 (#24650) (cherry picked from commit e78068a)
manas-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
Aug 26, 2025
…CVE-2025-8916 (apache#24650) (cherry picked from commit 2d50d16)
manas-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
Aug 26, 2025
…CVE-2025-8916 (apache#24650) (cherry picked from commit 2d50d16)
lhotari
added a commit
that referenced
this pull request
Aug 26, 2025
…CVE-2025-8916 (#24650) (cherry picked from commit e78068a)
nodece
pushed a commit
to ascentstream/pulsar
that referenced
this pull request
Aug 26, 2025
…CVE-2025-8916 (apache#24650) (cherry picked from commit e78068a)
srinath-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
Aug 28, 2025
…CVE-2025-8916 (apache#24650) (cherry picked from commit 2d50d16)
ganesh-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
Aug 29, 2025
…CVE-2025-8916 (apache#24650) (cherry picked from commit e78068a) (cherry picked from commit 76f06e1)
srinath-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
Sep 3, 2025
…CVE-2025-8916 (apache#24650) (cherry picked from commit e78068a) (cherry picked from commit 76f06e1)
Technoboy-
pushed a commit
to Technoboy-/pulsar
that referenced
this pull request
Sep 10, 2025
KannarFr
pushed a commit
to CleverCloud/pulsar
that referenced
this pull request
Sep 22, 2025
walkinggo
pushed a commit
to walkinggo/pulsar
that referenced
this pull request
Oct 8, 2025
catmsred
added a commit
to catmsred/os
that referenced
this pull request
Oct 21, 2025
bcpkix-jdk18on is brought in my pulsar. Upstream pulsar fixes this CVE [1], so bumping pulsar to the version that contains the fix. [1] apache/pulsar#24650 Relates: chainguard-dev/CVE-Dashboard#31498
catmsred
added a commit
to catmsred/os
that referenced
this pull request
Oct 21, 2025
bcpkix-jdk18on is brought in my pulsar. Upstream pulsar fixes this CVE [1], so bumping pulsar to the version that contains the fix. [1] apache/pulsar#24650 Relates: chainguard-dev/CVE-Dashboard#31498
catmsred
added a commit
to catmsred/os
that referenced
this pull request
Oct 21, 2025
bcpkix-jdk18on is brought in my pulsar. Upstream pulsar fixes this CVE [1], so bumping pulsar to the version that contains the fix. [1] apache/pulsar#24650 Relates: chainguard-dev/CVE-Dashboard#31498
powersj
pushed a commit
to wolfi-dev/os
that referenced
this pull request
Oct 22, 2025
bcpkix-jdk18on is brought in my pulsar. Upstream pulsar fixes this CVE [1], so bumping pulsar to the version that contains the fix. [1] apache/pulsar#24650 Relates: chainguard-dev/CVE-Dashboard#31498 <!--ci-cve-scan:must-fix: GHSA-4cx2-fc23-5wg6-->
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation & Modifications
Upgrade bouncycastle version to 1.79 to address CVE-2025-8916.
Since all bouncycastle libraries don't have aligned version numbers, the pom.xml has been modified so that different versions can be specified.
This CVE also applies to the
org.bouncycastle:bcpkix-fipsdependency, but there's no 1.0.8 version available yet. That will be upgraded in another PR when the fix is available.Documentation
docdoc-requireddoc-not-neededdoc-complete