Repository navigation
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The FIPS documentation still shows the previous provider version.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Upgrades the Bouncy Castle FIPS dependency set to address two high-severity CVEs.
Changes:
- Updates all Bouncy Castle FIPS artifacts to compatible releases.
- Adjusts FIPS integration tests for the new provider version.
| File | Description |
|---|---|
pom.xml |
Updates Bouncy Castle FIPS dependency versions. |
FipsDistTest.java |
Expects the upgraded provider version. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
eb8d1df to
2f5bf43
Compare
Closes keycloak#52974 Closes keycloak#52972 Signed-off-by: stianst <stianst@gmail.com>
2f5bf43 to
f9aa7e4
Compare
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Three configured dependency versions are unavailable from Maven Central and will prevent dependency resolution.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
|
@stianst It's the certificate used in the ldap has no SAN extension to localhost. It seems that BC now rejects the connection. For the moment we can add a System Property for it. If not we need to re-issue a certificate with localhost in the alternates. See this commit. I have tested it in my RHEL 9 VM with FIPS enabled. |
…and sets the server hostname via SSLParameters.setServerNames(). Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Dependency versions appear unavailable, and LDAP user-authentication StartTLS bypasses the new SNI handling.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
| // Wrap factory to ensure SNI hostname is set for endpoint verification | ||
| if (sslSocketFactory != null) { | ||
| sslSocketFactory = new SNIAwareSSLSocketFactory(sslSocketFactory); | ||
| } |
|
Closing in favor of #53139 |
Closes #52974
Closes #52972
Signed-off-by: stianst stianst@gmail.com