[RUN-4678] Remove unused net.i2p.crypto:eddsa dependency (CVE-2020-36843)#138
Conversation
) net.i2p.crypto:eddsa is unmaintained and flagged for CVE-2020-36843 (signature malleability). It is a direct, standalone dependency here and is not required transitively by sshj, asn-one, or BouncyCastle. sshj 0.40.0's Ed25519 signing/verification goes through the standard JCA "Ed25519" algorithm, which is natively supported by the JDK (17+) and by BouncyCastle, already pulled in transitively by sshj itself. Removing the dependency eliminates the CVE with no functional impact. Same fix as rundeck/rundeck#10394, applied here since this plugin declares the identical unused dependency.
There was a problem hiding this comment.
Pull request overview
Removes the unused net.i2p.crypto:eddsa dependency from this plugin’s Gradle version catalog and dependency configuration to address RUN-4678 / CVE-2020-36843, relying on Java 17’s native Ed25519 support and existing crypto dependencies already provided via sshj/BouncyCastle.
Changes:
- Removed the
eddsaversion and library entry from the Gradle version catalog. - Removed
libs.eddsafrom thepluginLibsdependency set inbuild.gradle.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
gradle/libs.versions.toml |
Drops the eddsa version and library definition from the version catalog. |
build.gradle |
Removes the libs.eddsa dependency from the pluginLibs configuration. |
|
@copilot resolve the merge conflicts in this pull request |
…ddsa-cve-2020-36843 # Conflicts: # gradle/libs.versions.toml
Resolved. The conflict in |
Summary
Removes the
net.i2p.crypto:eddsa:0.3.0dependency, resolving RUN-4678 / CVE-2020-36843 (signature malleability in EdDSA-Java, unmaintained upstream project). Same fix as rundeck/rundeck#10394, applied here since this plugin declared the identical unused dependency.Why this is safe
net.i2p.crypto:eddsawas a standalone dependency (build.gradle+gradle/libs.versions.toml) — confirmed via the resolvedpluginLibsdependency tree that nothing (sshj, asn-one, BouncyCastle) requires it transitively.sshj0.40.0's Ed25519 support goes through the standard JCA"Ed25519"algorithm name, not throughnet.i2p.crypto.eddsaclasses directly.net.i2p.crypto.eddsa/EdDSA/Ed25519directly.bcprov-jdk18on/bcpkix-jdk18on) is also already pulled in transitively bysshjitself.rundeck-plugins/git-pluginrepo independently arrived at the same conclusion — itsGitManager.groovyexplicitly strips theEdDSAsecurity provider at runtime if present, with a comment noting it "causesClassNotFoundExceptiondue to Rundeck's plugin classloader isolation" and that native JDK 15+ support should be used instead.Test plan
./gradlew dependencies --configuration pluginLibs— confirmednet.i2p.crypto:eddsano longer appears in the resolved graph./gradlew clean build— passes (compile, tests, javadoc, jar)sshj'sSignatureEdDSAclass directly (Ed25519 keygen, sign, verify) against this plugin's actual runtime classpath with the eddsa jar absent — signing and verification succeed via the JDK's native JCA provider