Roman Stepaniuk created CAMEL-25894:
---------------------------------------
Summary: Upgrade Bouncy Castle to 1.85 and document PQC migration
for Camel 4.18.6
Key: CAMEL-25894
URL: https://issues.apache.org/jira/browse/CAMEL-25894
Project: Camel
Issue Type: Dependency upgrade
Components: camel-pqc
Affects Versions: 4.18.5
Reporter: Roman Stepaniuk
Fix For: 4.18.6
Upgrade Bouncy Castle from 1.83 to 1.85 on {{camel-4.18.x}}, adapt
{{camel-pqc}} to the standardized algorithms, and document the migration in the
4.18.5 → 4.18.6 upgrade guide on {{main}}.
h3. CVE fixes
The upgrade includes fixes for the following eight CVEs referenced in the PR
review. The first three were fixed in BC 1.85; the remaining five were fixed in
BC 1.84 and are also covered by upgrading from 1.83 to 1.85.
|| CVE || Dependency issue || Fixed in BC ||
|
[CVE-2026-59649|https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059649]
| OpenPGP user-attribute parsing can exhaust memory. | 1.85 |
|
[CVE-2026-8763|https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763]
| Certificate name constraints can be bypassed using trailing dots. | 1.85 |
|
[CVE-2026-13506|https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013506]
| Nested ASN.1 input can bypass the depth limit and exhaust the stack. | 1.85 |
|
[CVE-2025-14813|https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813]
| GOST CTR counter handling fails beyond 255 blocks. | 1.84 |
|
[CVE-2026-3505|https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505]
| Untrusted OpenPGP AEAD chunk sizes can exhaust memory. | 1.84 |
|
[CVE-2026-5598|https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598]
| FrodoKEM timing differences can expose private keys. | 1.84 |
|
[CVE-2026-0636|https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636]
| LDAP certificate lookup accepts unescaped input. | 1.84 |
|
[CVE-2026-5588|https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588]
| Draft composite-signature verification accepts an empty signature sequence.
| 1.84 |
These are dependency-level fixes; applicability depends on the BC APIs used.
This list covers the review references. See the [official BC 1.85 CVE
summary|https://github.com/bcgit/bc-java/wiki/CVE-summary-1.85] for the broader
release list.
h3. Migration documentation
* {{DILITHIUM}}, {{SPHINCSPLUS}} and {{KYBER}} now use ML-DSA, SLH-DSA and
ML-KEM through the {{BC}} provider; update parameter-spec examples accordingly.
* Stored legacy Dilithium and SPHINCS+ keys must be regenerated, with
corresponding public keys updated at peers.
* The default SPHINCSPLUS parameter changes from {{haraka_256s}} (NIST category
5) to {{slh_dsa_sha2_128s}} (category 1). Users requiring category 5 should
select an SLH-DSA 256 parameter set.
h3. References
* Implementation: [PR #26519|https://github.com/apache/camel/pull/26519]
* Related documentation issue for Camel 4.22.2 / BC 1.86:
[CAMEL-25468|https://issues.apache.org/jira/browse/CAMEL-25468]
h3. Validation
AS2 API/component tests with Java 21 and BC 1.85 passed: 205 passed, one
existing manual test skipped. Full PR CI remains separate.
_Prepared with Codex on behalf of @lnearlol._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
