Skip to content

fix(deps): bump jruby-openssl to 0.16.2 for BC 1.85 CVE cluster #484

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jan-Kazlouski-elastic merged 2 commits into from
Aug 27, 2026
Merged

fix(deps): bump jruby-openssl to 0.16.2 for BC 1.85 CVE cluster #484

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8492110
fix(deps): bump jruby-openssl to 0.16.2 for CVE-2026-12185
Jan-Kazlouski-elastic Aug 26, 2026
3603906
Merge branch 'main' into jan-kazlouski/13614-cve-2026-12185-fix
Jan-Kazlouski-elastic Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,8 @@ RUN rm -rf /usr/local/bundle/gems/ruby-maven-* \
/usr/local/bundle/cache/ruby-maven-*

# Drop the vulnerable Bouncy Castle 1.79 jars from JRuby's default jruby-openssl
# 0.15.3 (CVE-2026-5588); the pinned 0.16.0 gem provides 1.84 at runtime.
# 0.15.3 (CVE-2026-5588); the pinned 0.16.2 gem provides BC 1.85 at runtime
# (CVE-2026-12185 and sibling BC 1.84 CVEs).
# Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246 and later): the default
# gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.5.15 gem
# from the Gemfile provides the fixed version at runtime.
Expand Down
3 changes: 2 additions & 1 deletion Dockerfile.wolfi
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,8 @@ RUN rm -rf /usr/local/bundle/gems/ruby-maven-* \
/usr/local/bundle/cache/ruby-maven-*

# Drop the vulnerable Bouncy Castle 1.79 jars from JRuby's default jruby-openssl
# 0.15.3 (CVE-2026-5588); the pinned 0.16.0 gem provides 1.84 at runtime.
# 0.15.3 (CVE-2026-5588); the pinned 0.16.2 gem provides BC 1.85 at runtime
# (CVE-2026-12185 and sibling BC 1.84 CVEs).
# Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246 and later): the default
# gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.5.15 gem
# from the Gemfile provides the fixed version at runtime.
Expand Down
7 changes: 4 additions & 3 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,10 @@ group :default do
gem 'erb', '4.0.4.1'
gem 'rufus-scheduler', '~> 3.9.1'

# jruby-openssl 0.16.0 bundles Bouncy Castle 1.84, fixing CVE-2026-5588.
# JRuby 9.4.12.0's default jruby-openssl 0.15.3 ships the vulnerable 1.79.
gem 'jruby-openssl', '0.16.0', platform: :jruby
# jruby-openssl 0.16.2 bundles Bouncy Castle 1.85, fixing CVE-2026-12185
# (and clearing the remaining BC 1.84 CVE cluster). JRuby 9.4.12.0's default
# jruby-openssl 0.15.3 ships BC 1.79; older pin 0.16.0 shipped BC 1.84.
gem 'jruby-openssl', '0.16.2', platform: :jruby

# JRuby 9.4.12.0 ships net-imap 0.2.3 as a default gem. Pin above the fixed
# lines for CVE-2026-42246 / CVE-2026-42257 / CVE-2026-42245 / CVE-2026-42258
Expand Down
4 changes: 2 additions & 2 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ GEM
i18n (1.15.2)
concurrent-ruby (~> 1.0)
ipaddr (1.2.6)
jruby-openssl (0.16.0-java)
jruby-openssl (0.16.2-java)
json (2.7.2-java)
json-schema (4.3.0)
addressable (>= 2.8)
Expand Down Expand Up @@ -191,7 +191,7 @@ DEPENDENCIES
faux!
httpclient
ipaddr (~> 1.2.4)
jruby-openssl (= 0.16.0)
jruby-openssl (= 0.16.2)
json (~> 2.7.2)
json-schema (~> 4.3.0)
net-imap (= 0.5.15)
Expand Down
2 changes: 1 addition & 1 deletion Jarfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jar 'org.jsoup:jsoup', '1.23.1'
# Cleaner Java logs handling
jar 'org.slf4j:slf4j-nop', '1.7.26'

# Pinned transitive to resolve CVE-2026-59646
# Pinned transitive to resolve CVE-2026-59646 / CVE-2026-12185 (BC < 1.85)
jar 'org.bouncycastle:bcprov-jdk18on', '1.85'
jar 'org.bouncycastle:bcpkix-jdk18on', '1.85'
jar 'org.bouncycastle:bctls-jdk18on', '1.85'
Expand Down
2 changes: 1 addition & 1 deletion NOTICE.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1597,7 +1597,7 @@ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.

--------------------------------------------------------------------------------
Library: jruby-openssl 0.16.0
Library: jruby-openssl 0.16.2
URL: https://github.com/jruby/jruby-openssl
License: EPL-1.0 OR GPL-2.0 OR LGPL-2.1

Expand Down
Loading