[HADOOP-17563] Update Bouncy Castle to 1.68 or later

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.1
• Fix Version/s: 3.4.0, 3.3.5
• Component/s: build
• Labels: pull-request-available
• Hadoop Flags: Incompatible change
• Release Note: bouncy castle 1.68+ is a multirelease JAR containing java classes compiled for different target JREs. older versions of asm.jar and maven shade plugin may have problems with these. fix: upgrade the dependencies
• Assignee: PJ Fanning
• Reporter: Takanobu Asanuma
• Created: 04/Mar/21 01:59
• Updated: 12/Apr/23 06:45
• Resolved: 17/Oct/22 17:28

Description

Bouncy Castle 1.60 has Hash Collision Vulnerability. Let's update to 1.68.

Bouncy Castle 1.60 has the following vulnerabilities. Let's update to 1.68.

• https://nvd.nist.gov/vuln/detail/CVE-2020-26939
• https://nvd.nist.gov/vuln/detail/CVE-2020-28052
• https://nvd.nist.gov/vuln/detail/CVE-2020-15522

for anyone backporting this, note that recent bouncy castle jars are incompatible with older versions of asm.jar, and so older versions of spark.

Issue Links

• is blocked by: SPARK-29729 Upgrade ASM to 7.2
• is duplicated by: HADOOP-17898 Upgrade BouncyCastle to 1.69
• is related to: SPARK-41392 Add `bouncy-castle` test dependencies to `sql/core` module for Hadoop 3.4.0
• is related to: HIVE-26063 Upgrade Apache parent POM to version 25
• relates to: BIGTOP-3926 Fix build failure of Hive against Hadoop 3.3.5
• links to: GitHub Pull Request #2740
• links to: GitHub Pull Request #3055
• links to: GitHub Pull Request #3405
• links to: GitHub Pull Request #5015