Skip to content

Commit 65da473

Browse files
authored
Bumping bouncycastle dependencies to remove vulnerabilities (#41334)
### What does this PR do? Updates the [Bouncy Castle](https://www.bouncycastle.org/) dependencies to the latest versions. ### Motivation This was done to mitigate against CVE-2025-8885 and CVE-2025-8916 in FIPS images. ### Describe how you validated your changes There is an e2e test that checks JMXFetch still works in the FIPS images.
1 parent cd70123 commit 65da473

2 files changed

Lines changed: 9 additions & 4 deletions

File tree

Dockerfiles/agent/bouncycastle-fips/pom.xml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,22 +19,22 @@
1919
<dependency>
2020
<groupId>org.bouncycastle</groupId>
2121
<artifactId>bc-fips</artifactId>
22-
<version>2.0.0</version>
22+
<version>2.0.1</version>
2323
</dependency>
2424
<dependency>
2525
<groupId>org.bouncycastle</groupId>
2626
<artifactId>bcpkix-fips</artifactId>
27-
<version>2.0.7</version>
27+
<version>2.0.8</version>
2828
</dependency>
2929
<dependency>
3030
<groupId>org.bouncycastle</groupId>
3131
<artifactId>bctls-fips</artifactId>
32-
<version>2.0.19</version>
32+
<version>2.0.20</version>
3333
</dependency>
3434
<dependency>
3535
<groupId>org.bouncycastle</groupId>
3636
<artifactId>bcutil-fips</artifactId>
37-
<version>2.0.3</version>
37+
<version>2.0.5</version>
3838
</dependency>
3939
</dependencies>
4040

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
security:
3+
- |
4+
Bumped Bouncy Castle dependencies to mitigate against CVE-2025-8885 and CVE-2025-8916
5+
in FIPS images.

0 commit comments

Comments
 (0)