You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@shardingsphere.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2025/10/17 14:03:26 UTC
[PR] Bump org.bouncycastle:bcpkix-jdk18on from 1.78.1 to 1.79 [shardingsphere]
dependabot[bot] opened a new pull request, #36893:
URL: https://github.com/apache/shardingsphere/pull/36893
Bumps [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) from 1.78.1 to 1.79.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html">org.bouncycastle:bcpkix-jdk18on's changelog</a>.</em></p>
<blockquote>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted -->2.1.1 Version<!-- raw HTML omitted --><!-- raw HTML omitted -->
Release: 1.83<!-- raw HTML omitted -->
Date: TBD</p>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted -->2.2.1 Version<!-- raw HTML omitted --><!-- raw HTML omitted -->
Release: 1.82<!-- raw HTML omitted -->
Date: 2025, 17th September.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/bcgit/bc-java/commits">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/shardingsphere/network/alerts).
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump org.bouncycastle:bcpkix-jdk18on from 1.78.1 to 1.79 [shardingsphere]
Posted by "terrymanu (via GitHub)" <gi...@apache.org>.
terrymanu commented on PR #36893:
URL: https://github.com/apache/shardingsphere/pull/36893#issuecomment-3486716712
Apache ShardingSphere PR #36893 Analysis Report
PR Overview
PR Title: Bump org.bouncycastle:bcpkix-jdk18on from 1.78.1 to 1.79Creator: dependabot[bot]Change Content: Upgrade BouncyCastle version from 1.78.1 to 1.79 in root pom.xmlChanged Files: Only pom.xml (1 line modified)
1. BouncyCastle Usage in ShardingSphere
1.1 Dependency Scope
- Mainly used in proxy/frontend/core module
- Includes two dependencies:
- bcpkix-jdk18on: PKIX/X.509 related functionality
- bctls-jdk18on: TLS/SSL related functionality
1.2 Specific Usage
- SSL Certificate Generation: Used in SSLUtils.java:65-86 to generate RSA key pairs and self-signed X.509 certificates
- Proxy SSL Support: Provides SSL/TLS encrypted communication capability for ShardingSphere Proxy
- Security Provider: Registered as Java security provider to support encryption algorithms
2. Analysis of Major Changes in Version 1.79
2.1 Security Fixes (Key Focus)
CVEs Fixed in Version 1.78:
- CVE-2024-29857: CPU usage issue during EC certificate parsing
- CVE-2024-30171: Timing attack vulnerability in RSA handshakes
- CVE-2024-30172: Infinite loop vulnerability in Ed25519 verification code
- CVE-2024-34447: Hostname verification against IP addresses issue
New Fixes in Version 1.79:
- Fixed issue where leading zeros were sometimes dropped from Ed25519 signatures causing verification errors in PGP API
- Fixed Elephant cipher failure on large messages
- Fixed multiple CMS-related encoding and version calculation issues
- Fixed Java 21 compatibility issues (Provider service class handling)
2.2 Compatibility Improvements
- Enhanced Java 21 compatibility
- Improved PGP API algorithm name truncation issues
- Fixed multiple CMS and certificate processing related issues
2.3 Feature Enhancements
- Added new post-quantum cryptography algorithm support (ML-KEM, ML-DSA, SLH-DSA)
- Improved BCJSSE security property support
- Enhanced PGP API functionality
3. Impact Analysis
3.1 Correctness Assessment ✅
PR is Correct:
- This is a standard dependency version upgrade
- Automatically created by Dependabot with minimal changes
- Only involves version number changes, no code logic modifications
3.2 Security Impact ✅
Positive Impact:
- Fixes multiple security vulnerabilities, especially Ed25519 signature verification issues
- Improves Java 21 compatibility
- Enhances SSL/TLS implementation security
3.3 Compatibility Risk ⚠️
Low Risk:
- BouncyCastle 1.79 is a backward-compatible patch version
- APIs used by ShardingSphere (certificate generation, SSL) remain stable
- No breaking changes found
Need Attention:
- Java 21 environment compatibility issues have been fixed
- PGP-related default behaviors may have minor adjustments
3.4 Performance Impact ⚪
Neutral Impact:
- Performance improvements mainly focus on specific algorithms (like Elephant)
- SSL certificate generation performance has no significant changes
- Overall performance impact is negligible
3.5 Functional Completeness ✅
Maintained Completeness:
- ShardingSphere's SSL functionality completely relies on BouncyCastle's basic features
- Core functions like certificate generation and RSA key pair generation remain unchanged
- Existing test coverage is sufficient to verify functional correctness
4. Test Coverage Analysis
4.1 Existing Tests
- SSLUtilsTest.java provides basic functional tests
- Tests cover RSA key pair generation and self-signed certificate generation
- Includes certificate verification and exception case testing
4.2 Test Sufficiency
Current testing is sufficient for dependency upgrade because:
- Only tests public API behavior, not dependent on internal implementation
- Covers BouncyCastle functionality actually used by ShardingSphere
5. Risk Assessment and Recommendations
5.1 Overall Risk Rating: Low Risk ✅
5.2 Main Benefits
- Security Improvement: Fixes multiple CVEs and security vulnerabilities
- Compatibility Enhancement: Better Java 21 support
- Maintainability: Keeps dependency library up-to-date
5.3 Potential Risks (Very Low)
- Theoretical compatibility issues (historically BouncyCastle patch versions are very stable)
- Need to update version declaration in LICENSE file
5.4 Recommendations
Strongly recommend merging this PR for the following reasons:
1. Security Necessity: Fixes multiple security issues including Ed25519 signature verification
2. Good Compatibility: Patch version upgrade with very low risk
3. Sufficient Testing: Existing tests can verify functional correctness
4. Maintenance Best Practice: Keep security dependencies updated in a timely manner
5.5 Post-Merge Recommended Actions
- Update version declaration in distribution/proxy/src/main/release-docs/LICENSE
- Run complete test suite to verify functional correctness
- Consider additional testing in Java 21 environment
Conclusion
PR #36893 is correct and necessary. This is a low-risk, high-benefit security upgrade that is strongly recommended for merging. The upgrade will enhance ShardingSphere's security, improve Java 21 compatibility, and will
not affect the stability of existing functionality.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump org.bouncycastle:bcpkix-jdk18on from 1.78.1 to 1.79 [shardingsphere]
Posted by "terrymanu (via GitHub)" <gi...@apache.org>.
terrymanu merged PR #36893:
URL: https://github.com/apache/shardingsphere/pull/36893
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org