[AMBARI-24507] Remove dependency on org.bouncycastle bcprov-jdk15on before version 1.6.0 for Ambari Server

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 2.7.1
• Fix Version/s: 2.7.1
• Component/s: ambari-server
• Labels: pull-request-available
• Assignee: Robert Levas
• Reporter: Robert Levas
• Created: 20/Aug/18 21:19
• Updated: 21/Aug/18 10:25
• Resolved: 21/Aug/18 09:34

Description

Remove dependency on org.bouncycastle bcprov-jdk15on before version 1.6.0 for Ambari Server security concerns. See

• CVE-2018-1000180 - https://nvd.nist.gov/vuln/detail/CVE-2018-1000180

This dependency is compiled into the apacheds-all.jar from

    <dependency>
      <groupId>org.apache.directory.server</groupId>
      <artifactId>apacheds-all</artifactId>
      <version>2.0.0-M24</version>
    </dependency>

The relevant parts of this need to be broken out and the offending bouncy castle JAR needs to be excluded as needed.

Issue Links

• links to: GitHub Pull Request #2121
• links to: GitHub Pull Request #2122