Roman Stepaniuk created CAMEL-25468:
---------------------------------------
Summary: Upgrade Bouncy Castle to 1.86 on Camel 4.22.x
Key: CAMEL-25468
URL: https://issues.apache.org/jira/browse/CAMEL-25468
Project: Camel
Issue Type: Dependency upgrade
Components: build system, camel-pqc
Affects Versions: 4.22.1, 4.22.0
Reporter: Roman Stepaniuk
Fix For: 4.22.2
Backport the Bouncy Castle 1.86 upgrade and the required camel-pqc
compatibility changes to Camel 4.22.x, targeting release 4.22.2.
Security rationale
Camel 4.22.0 and 4.22.1 use Bouncy Castle 1.85. The vendor advisories identify
regular Bouncy Castle Java versions before 1.86 as affected and 1.86 as the
fixed version for the following published CVEs. Therefore, upgrading to 1.85.2
would not provide these fixes:
- CVE-2026-18036:
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9018036
- CVE-2026-18040:
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9018040
- CVE-2026-17508:
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9017508
- CVE-2026-85515:
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9085515
- CVE-2026-97873:
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9097873
Compatibility and migration
Bouncy Castle 1.86 removes legacy post-quantum implementations and
parameter-spec classes, requiring the following camel-pqc changes:
- Remove the PICNIC signatureAlgorithm value, PQCSignatureAlgorithms.PICNIC and
PQCDefaultPicnicMaterial.
- Move CMCE and FRODO from BCPQC to the BC provider.
- Change lifecycle-manager defaults from mceliece348864 to mceliece460896 and
from frodokem640aes to frodokem976aes.
- Regenerate stored CMCE, FRODO and Picnic keys and update the peers they are
shared with.
- Use standardized parameter-set names for DILITHIUM and SPHINCSPLUS. The
dilithium2, dilithium3 and dilithium5 names are no longer accepted; the
sha2_128s alias remains supported.
These breaking changes are documented in the component documentation and the
Camel 4.22.2 upgrade-guide entry on main.
Related pull requests
Original implementation on main:
https://github.com/apache/camel/pull/27052
Camel 4.22.x backport:
https://github.com/apache/camel/pull/27500
Camel 4.22.2 upgrade guide and documentation/test follow-up:
https://github.com/apache/camel/pull/27562
Requested fix version: 4.22.2.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
