AthiraHari77 opened a new issue, #2391: URL: https://github.com/apache/incubator-kie-issues/issues/2391
Security vulnerabilities detected in library: bcprov-jdk18on-1.84.jar, bcpkix-jdk18on-1.84.jar, bcutil-jdk18on-1.84.jar Description: In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12. Proposed Fixes: 1. CVE-2026-59650 (Critical - CVSS 9.1) Fix Versions: org.bouncycastle:bcprov-jdk15to18:1.85 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcprov-jdk18on:1.85 r1rv85 2. CVE-2026-58062 (Critical - CVSS 9.1) Fix Versions: org.bouncycastle:bc-fips:2.0.2 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bc-fips:2.1.3 org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bcprov-jdk15to18:1.85 r1rv85 3. CVE-2026-8763 (Critical - CVSS 9.1) Fix Versions: org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bcprov-jdk15to18:1.85 org.bouncycastle:bc-fips:1.0.2.7 org.bouncycastle:bc-fips:2.1.3 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bc-fips:2.0.2 r1rv85 4. CVE-2026-12803 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bcprov-jdk15to18:1.85 org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bcprov-lts8on:2.73.12 r1rv85 5. CVE-2026-12860 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcprov-jdk15to18:1.85 r1rv85 6. CVE-2026-12816 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bcprov-jdk15to18:1.85 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcprov-jdk18on:1.85 r1rv85 7. CVE-2026-13506 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bc-fips:2.0.2 org.bouncycastle:bc-fips:2.1.3 org.bouncycastle:bc-fips:1.0.2.7 org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bcprov-jdk15to18:1.85 r1rv85 8. CVE-2026-58060 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bc-fips:2.1.3 org.bouncycastle:bcprov-jdk15to18:1.85 org.bouncycastle:bc-fips:2.0.2 r1rv85 9. CVE-2026-14682 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bc-fips:2.1.3 org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bc-fips:1.0.2.7 org.bouncycastle:bc-fips:2.0.2 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcprov-jdk15to18:1.85 r1rv85 10. CVE-2026-58061 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bc-fips:2.1.3 org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bc-fips:2.0.2 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcprov-jdk15to18:1.85 org.bouncycastle:bc-fips:1.0.2.7 r1rv85 11. CVE-2026-58059 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bc-fips:1.0.2.7 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bc-fips:2.1.3 org.bouncycastle:bc-fips:2.0.2 org.bouncycastle:bcprov-jdk15to18:1.85 r1rv85 12. CVE-2026-12802 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bcpkix-lts8on:2.73.12 org.bouncycastle:bcpkix-fips:2.1.12 org.bouncycastle:bcpkix-jdk18on:1.85 org.bouncycastle:bcpkix-fips:1.0.12 org.bouncycastle:bcpkix-fips:2.0.12 org.bouncycastle:bcpkix-jdk15to18:1.85 r1rv85 13. CVE-2026-59639 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bcpkix-jdk18on:1.85 org.bouncycastle:bcpkix-lts8on:2.73.12 org.bouncycastle:bcpkix-fips:1.0.12 org.bouncycastle:bcpkix-jdk15to18:1.85 org.bouncycastle:bcpkix-fips:2.1.12 org.bouncycastle:bcpkix-fips:2.0.12 r1rv85 14. CVE-2026-59642 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bcpkix-fips:1.0.12 org.bouncycastle:bcpkix-fips:2.0.12 org.bouncycastle:bcpkix-jdk15to18:1.85 org.bouncycastle:bcpkix-fips:2.1.12 org.bouncycastle:bcpkix-jdk18on:1.85 org.bouncycastle:bcpkix-lts8on:2.73.12 r1rv85 15. CVE-2026-59645 (High - CVSS 7.5) Fix Versions: org.bouncycastle:bcutil-lts8on:2.73.12 org.bouncycastle:bcutil-fips:2.1.7 org.bouncycastle:bcutil-jdk18on:1.85 org.bouncycastle:bcutil-jdk15to18:1.85 org.bouncycastle:bcutil-fips:2.0.7 r1rv85 16. CVE-2026-12185 (Medium - CVSS 6.5) Fix Versions: org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bcprov-jdk15to18:1.85 r1rv85 17. CVE-2026-13586 (Medium - CVSS 4.3) Fix Versions: org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bc-fips:2.0.2 org.bouncycastle:bcpkix-jdk15to18:1.85 org.bouncycastle:bcpkix-lts8on:2.73.12 org.bouncycastle:bc-fips:1.0.2.7 org.bouncycastle:bc-fips:2.1.3 org.bouncycastle:bcpkix-jdk18on:1.85 org.bouncycastle:bcprov-jdk15to18:1.85 org.bouncycastle:bcprov-jdk18on:1.85 r1rv85 18. CVE-2026-59648 (Medium - CVSS 5.3) Fix Versions: org.bouncycastle:bcpg-fips:1.0.13 org.bouncycastle:bcpg-jdk18on:1.85 org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcpg-jdk15to18:1.85 org.bouncycastle:bcpg-fips:2.0.13 org.bouncycastle:bcprov-jdk15to18:1.85 org.bouncycastle:bcpg-lts8on:2.73.12 org.bouncycastle:bcpg-fips:2.1.13 r1rv85 19. CVE-2026-59647 (Medium - CVSS 5.3) Fix Versions: org.bouncycastle:bcpkix-lts8on:2.73.12 org.bouncycastle:bcpkix-jdk18on:1.85 org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bcpkix-fips:2.0.12 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcpkix-fips:2.1.12 org.bouncycastle:bcpkix-fips:1.0.12 org.bouncycastle:bcpkix-jdk15to18:1.85 org.bouncycastle:bcprov-jdk15to18:1.85 r1rv85 20. CVE-2026-15055 (Medium - CVSS 4.3) Fix Versions: org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcpkix-fips:2.1.12 org.bouncycastle:bcpkix-fips:1.0.12 org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bcpkix-lts8on:2.73.12 org.bouncycastle:bcpkix-jdk15to18:1.85 org.bouncycastle:bcpkix-fips:2.0.12 org.bouncycastle:bcpkix-jdk18on:1.85 org.bouncycastle:bcprov-jdk15to18:1.85 r1rv85 21. CVE-2026-58063 (Medium - CVSS 4.3) Fix Versions: org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bc-fips:2.0.2 org.bouncycastle:bc-fips:1.0.2.7 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcprov-jdk15to18:1.85 org.bouncycastle:bc-fips:2.1.3 r1rv85 22. CVE-2026-59652 (Medium - CVSS 6.5) Fix Versions: org.bouncycastle:bcprov-jdk15to18:1.85 org.bouncycastle:bcprov-jdk18on:1.85 r1rv85 23. CVE-2026-59651 (Medium - CVSS 6.5) Fix Versions: org.bouncycastle:bcprov-jdk18on:1.85 org.bouncycastle:bcprov-lts8on:2.73.12 org.bouncycastle:bcprov-jdk15to18:1.85 r1rv85 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
