[HADOOP-19024] Use bouncycastle jdk18 1.77

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.5.0, 3.4.1
• Labels: pull-request-available
• Hadoop Flags: Reviewed
• Assignee: PJ Fanning
• Reporter: PJ Fanning
• Created: 04/Jan/24 16:04
• Updated: 08/Jul/24 11:43
• Resolved: 30/Mar/24 14:35

Description

They have stopped patching the JDK 1.5 jars that Hadoop uses (see https://issues.apache.org/jira/browse/HADOOP-18540).

The new artifacts have similar names - but the names are like bcprov-jdk18on as opposed to bcprov-jdk15on.

CVE-2023-33201 is an example of a security issue that seems only to be fixed in the JDK 1.8 artifacts (ie no JDK 1.5 jar has the fix).

https://www.bouncycastle.org/releasenotes.html#r1rv77 latest current release but the CVE was fixed in 1.74.

Issue Links

• relates to: HBASE-28714 Hadoop check for hadoop 3.4.0 is failing
• relates to: HADOOP-18540 Upgrade Bouncy Castle to 1.70
• links to: GitHub Pull Request #6410