This is an automated email from the ASF dual-hosted git repository.
porcelli pushed a commit to branch main
in repository
https://gitbox.apache.org/repos/asf/incubator-kie-kogito-runtimes.git
The following commit(s) were added to refs/heads/main by this push:
new dd10e6ede5 kie-issues#1199 - CVE-2024-30171, CVE-2024-30172,
CVE-2024-29857: bc*-jdk18on upgrade. (#3510)
dd10e6ede5 is described below
commit dd10e6ede5552fd64d1ec5f35e3dd43f8fe594e7
Author: Alex Porcelli <[email protected]>
AuthorDate: Tue May 14 11:28:17 2024 +0200
kie-issues#1199 - CVE-2024-30171, CVE-2024-30172, CVE-2024-29857:
bc*-jdk18on upgrade. (#3510)
---
kogito-build/kogito-dependencies-bom/pom.xml | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/kogito-build/kogito-dependencies-bom/pom.xml
b/kogito-build/kogito-dependencies-bom/pom.xml
index ed8f8f66d0..7c1c971788 100644
--- a/kogito-build/kogito-dependencies-bom/pom.xml
+++ b/kogito-build/kogito-dependencies-bom/pom.xml
@@ -40,6 +40,8 @@
<version.org.springframework.boot>3.2.4</version.org.springframework.boot>
<version.org.apache.kafka>3.6.1</version.org.apache.kafka>
+
<version.org.bouncycastle.bc.jdk18on>1.78.1</version.org.bouncycastle.bc.jdk18on>
+
<!-- dependencies versions -->
<version.com.networknt>1.0.86</version.com.networknt>
<version.com.fasterxml.jackson>2.16.1</version.com.fasterxml.jackson>
@@ -154,6 +156,25 @@
<dependencyManagement>
<dependencies>
+ <!-- Not directly used, but a vulnerable version has been brought from
com.dajudge.kindcontainer dependency -->
+ <dependency>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bcpkix-jdk18on</artifactId>
+ <version>${version.org.bouncycastle.bc.jdk18on}</version>
+ </dependency>
+
+ <dependency>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bcprov-jdk18on</artifactId>
+ <version>${version.org.bouncycastle.bc.jdk18on}</version>
+ </dependency>
+
+ <dependency>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bcutil-jdk18on</artifactId>
+ <version>${version.org.bouncycastle.bc.jdk18on}</version>
+ </dependency>
+
<!-- Guava should not be used directly by Kogito, here we are managing
it to override dependency added by GRPC to fix this CVE:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2976 -->
<dependency>
<groupId>com.google.guava</groupId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
