Skip to content

fix(deps): bump jruby-openssl to 0.16.2 for BC 1.85 CVE cluster - #484

Merged
Jan-Kazlouski-elastic merged 2 commits into
mainfrom
jan-kazlouski/13614-cve-2026-12185-fix
Aug 27, 2026
Merged

fix(deps): bump jruby-openssl to 0.16.2 for BC 1.85 CVE cluster#484
Jan-Kazlouski-elastic merged 2 commits into
mainfrom
jan-kazlouski/13614-cve-2026-12185-fix

Conversation

@Jan-Kazlouski-elastic

@Jan-Kazlouski-elastic Jan-Kazlouski-elastic commented Aug 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Part of https://github.com/elastic/security/issues/13614
Part of https://github.com/elastic/security/issues/13615
Part of https://github.com/elastic/security/issues/13616
Part of https://github.com/elastic/security/issues/13617
Part of https://github.com/elastic/security/issues/13618
Part of https://github.com/elastic/security/issues/13619
Part of https://github.com/elastic/security/issues/13620
Part of https://github.com/elastic/security/issues/13621
Part of https://github.com/elastic/security/issues/13622
Part of https://github.com/elastic/security/issues/13624
Part of https://github.com/elastic/security/issues/13625
Part of https://github.com/elastic/security/issues/13626
Part of https://github.com/elastic/security/issues/13627
Part of https://github.com/elastic/security/issues/13628
Part of https://github.com/elastic/security/issues/13629
Part of https://github.com/elastic/security/issues/13630
Part of https://github.com/elastic/security/issues/13631
Part of https://github.com/elastic/security/issues/13632
Part of https://github.com/elastic/security/issues/13633
Part of https://github.com/elastic/security/issues/13634
Part of https://github.com/elastic/security/issues/13635
Part of https://github.com/elastic/security/issues/13636
Part of https://github.com/elastic/security/issues/13639

Bump jruby-openssl from 0.16.0 to 0.16.2 so the gem-bundled Bouncy Castle jars move from 1.84 → 1.85, clearing the full BC 1.84 CVE cluster flagged by Snyk on docker.elastic.co/integrations/crawler:1.0.0-SNAPSHOT.

Snyk finding path (example):
/usr/local/bundle/gems/jruby-openssl-0.16.0-java/lib/org/bouncycastle/bcprov-jdk18on/1.84

(Jarfile already pins BC 1.85 under vendor/jars; the gem-bundled copy was the remaining hit.)

Version choice

  • 0.16.2 (2026-07-20): explicit [deps] upgrade BC to version 1.85 — minimal fix for this group.
  • 0.19.0 exists (newer) but upstream marks it as a beta-class release (BC JSSE by default, large TLS/X.509 rewrite). Not taken for this security patch.

Scanner A/B (BC 1.84 cluster — all linked issues)

Baseline: jruby-openssl 0.16.0 (BC 1.84 gem jars) → 0.16.2 (BC 1.85).

Method: Snyk jar scan on the four Bouncy Castle artifacts extracted from each gem (bcprov, bcpkix, bctls, bcutil). Trivy/pip-audit not applicable (Java gem jars).

CVE Severity Issue Before After
CVE-2026-58062 Critical #13627 reported clear
CVE-2026-59638 Critical #13629 reported clear
CVE-2026-59650 Critical #13635 reported clear
CVE-2026-8763 Critical #13639 reported clear
CVE-2026-12185 High #13614 reported clear
CVE-2026-12802 High #13615 reported clear
CVE-2026-12803 High #13616 reported clear
CVE-2026-12816 High #13617 reported clear
CVE-2026-12860 High #13618 reported clear
CVE-2026-13506 High #13619 reported clear
CVE-2026-14682 High #13621 reported clear
CVE-2026-58059 High #13624 reported clear
CVE-2026-58060 High #13625 reported clear
CVE-2026-58061 High #13626 reported clear
CVE-2026-59639 High #13630 reported clear
CVE-2026-59642 High #13631 reported clear
CVE-2026-59645 High #13632 reported clear
CVE-2026-59646 High #13633 reported clear
CVE-2026-59651 High #13636 reported clear
CVE-2026-13586 Medium #13620 reported clear
CVE-2026-15055 Medium #13622 reported clear
CVE-2026-58063 Medium #13628 reported clear
CVE-2026-59647 Medium #13634 reported clear

23/23 CVEs: reported → clear. Container re-publish + snyk container monitor still needed for dashboard refresh.

Checklists

Pre-Review Checklist

  • This PR does NOT contain credentials of any kind, such as API keys or username/passwords (double check crawler.yml.example and elasticsearch.yml.example)
  • This PR has a meaningful title
  • This PR links to all relevant GitHub issues that it fixes or partially addresses
  • this PR has a thorough description
  • Covered the changes with automated tests
  • Tested the changes locally (make install, make lint, make test — 690 examples, 0 failures)
  • Added a label for each target release version (example: v0.1.0)
  • Considered corresponding documentation changes
  • Contributed any configuration settings changes to the configuration reference
  • Ran make notice if any dependencies have been added

Changes Requiring Extra Attention

  • Security-related changes (encryption, TLS, SSRF, etc)

Related Pull Requests

N/A

Release Note

Bump jruby-openssl to 0.16.2 to pick up Bouncy Castle 1.85 (CVE-2026-12185 and sibling BC 1.84 CVEs).

@Jan-Kazlouski-elastic
fix(deps): bump jruby-openssl to 0.16.2 for CVE-2026-12185
8492110 
jruby-openssl 0.16.0 bundled Bouncy Castle bcprov 1.84; 0.16.2 ships 1.85, which fixes CVE-2026-12185 (BKS/UBER keystore memory allocation).

Part of elastic/security#13614
@Jan-Kazlouski-elastic
Jan-Kazlouski-elastic requested a review from a team as a code owner August 26, 2026 10:05
@Jan-Kazlouski-elastic Jan-Kazlouski-elastic self-assigned this Aug 26, 2026
@Jan-Kazlouski-elastic Jan-Kazlouski-elastic changed the title fix(deps): bump jruby-openssl to 0.16.2 for CVE-2026-12185 fix(deps): bump jruby-openssl to 0.16.2 for BC 1.85 CVE cluster Aug 26, 2026
@Jan-Kazlouski-elastic
Jan-Kazlouski-elastic enabled auto-merge (squash) August 27, 2026 14:33
@Jan-Kazlouski-elastic
Jan-Kazlouski-elastic merged commit a19c933 into main Aug 27, 2026
2 checks passed
@Jan-Kazlouski-elastic
Jan-Kazlouski-elastic deleted the jan-kazlouski/13614-cve-2026-12185-fix branch August 27, 2026 14:44
@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown

💔 Failed to create backport PR(s)

Status Branch Result
❌ 1.0 Commit could not be cherrypicked due to conflicts

To backport manually run:
backport --pr 484 --autoMerge --autoMergeMethod squash

@Jan-Kazlouski-elastic Jan-Kazlouski-elastic mentioned this pull request Aug 28, 2026
Merged
Jan-Kazlouski-elastic added a commit that referenced this pull request Aug 28, 2026
@Jan-Kazlouski-elastic
[1.0] fix(deps): bump jruby-openssl to 0.16.2 for BC 1.85 CVE cluster (…
66c40e6 
…#484) (#489)

Backport of #484 to `1.0`.

Auto-backport failed due to `Jarfile` conflict (1.0 lacked BC pin block;
resolved manually, kept `httpclient5` at 5.6.2 — see #487 for that
bump).

Part of elastic/security#13614 (+ 22 sibling
BC issues linked in #484).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@erikcurrin-elastic erikcurrin-elastic erikcurrin-elastic approved these changes

Assignees

@Jan-Kazlouski-elastic Jan-Kazlouski-elastic

Labels

auto-backport release_note team:extract-and-transform v1.0.1

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Jan-Kazlouski-elastic @erikcurrin-elastic