From 587c55e771b5258e8113f07852f324e3dd1808d3 Mon Sep 17 00:00:00 2001 From: Rundeck CI Date: Wed, 22 Jul 2026 13:12:03 -0700 Subject: [PATCH] [RUN-4678] Remove unused net.i2p.crypto:eddsa dependency (CVE-2020-36843) net.i2p.crypto:eddsa is unmaintained and flagged for CVE-2020-36843 (signature malleability). It is a direct, standalone dependency here and is not required transitively by sshj, asn-one, or BouncyCastle. sshj 0.40.0's Ed25519 signing/verification goes through the standard JCA "Ed25519" algorithm, which is natively supported by the JDK (17+) and by BouncyCastle, already pulled in transitively by sshj itself. Removing the dependency eliminates the CVE with no functional impact. Same fix as rundeck/rundeck#10394, applied here since this plugin declares the identical unused dependency. --- build.gradle | 1 - gradle/libs.versions.toml | 2 -- 2 files changed, 3 deletions(-) diff --git a/build.gradle b/build.gradle index dfa2edc..cd82ed7 100644 --- a/build.gradle +++ b/build.gradle @@ -60,7 +60,6 @@ configurations{ dependencies { pluginLibs libs.sshj pluginLibs libs.asnOne - pluginLibs libs.eddsa pluginLibs libs.bundles.bouncycastle pluginLibs libs.expectitCore diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 5ec3e80..73fdc79 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -1,7 +1,6 @@ [versions] sshj = "0.40.0" asnOne = "0.6.0" -eddsa = "0.3.0" bouncycastle = "1.84" expectit = "0.9.0" commonsIo = "2.22.0" @@ -20,7 +19,6 @@ commonsLang3 = "3.20.0" [libraries] sshj = { group = "com.hierynomus", name = "sshj", version.ref = "sshj" } asnOne = { group = "com.hierynomus", name = "asn-one", version.ref = "asnOne" } -eddsa = { group = "net.i2p.crypto", name = "eddsa", version.ref = "eddsa" } bcpkix = { group = "org.bouncycastle", name = "bcpkix-jdk18on", version.ref = "bouncycastle" } bcprov = { group = "org.bouncycastle", name = "bcprov-jdk18on", version.ref = "bouncycastle" } expectitCore = { group = "net.sf.expectit", name = "expectit-core", version.ref = "expectit" }