From 09859d52496f220646c2fa330ca124f8f4d78694 Mon Sep 17 00:00:00 2001 From: shreyah963 Date: Tue, 30 Jun 2026 15:20:56 -0700 Subject: [PATCH] Fix CVE-2026-0636, CVE-2026-34478, CVE-2026-34477, CVE-2026-34480: bump bcprov-jdk18on and force log4j-core Bump org.bouncycastle:bcprov-jdk18on from 1.80 to 1.84 to address GHSA-c3fc-8qff-9hwx (versions >=1.74 <1.84 are vulnerable). Force org.apache.logging.log4j:log4j-core to 2.25.4 to address GHSA-445c-vh5m-36rj, GHSA-6hg6-v5c8-fphq, and GHSA-3pxv-7cmr-fjr4 (versions <2.25.4 are vulnerable). Signed-off-by: shreyah963 --- build.gradle | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index 4e5e683be..795d5d7d2 100644 --- a/build.gradle +++ b/build.gradle @@ -195,7 +195,7 @@ dependencies { implementation "software.amazon.cryptography:aws-cryptographic-material-providers:1.8.0" implementation "org.dafny:DafnyRuntime:4.9.1" implementation "software.amazon.smithy.dafny:conversion:0.1.1" - implementation 'org.bouncycastle:bcprov-jdk18on:1.80' + implementation 'org.bouncycastle:bcprov-jdk18on:1.84' implementation "jakarta.json.bind:jakarta.json.bind-api:3.0.1" implementation "org.glassfish:jakarta.json:2.0.1" implementation "org.eclipse:yasson:3.0.4" @@ -226,6 +226,7 @@ dependencies { configurations.all { resolutionStrategy { force("com.google.guava:guava:33.4.0-jre") // CVE for 31.1, keep to force transitive dependencies + force("org.apache.logging.log4j:log4j-core:2.25.4") // CVE-2026-34478, CVE-2026-34477, CVE-2026-34480 } } }