CVE fixes?

[Neustradamus]

It is possible to secure Jitsi?

CVEs:

• Bouncy Castle CVEs: Bouncy Castle 1.70 (2021-11-29) instead of 1.54 (CVEs) #562 + Bouncy Castle 1.67 instead of 1.54 (#562) #564 + Bump bcprov-jdk15on from 1.54 to 1.67 in /m2 #741
• slf4j CVE: Update slf4j to 1.7.32 (CVE-2018-8088) #667
• log4j CVEs: log4j CVEs #754 + log4j Vulnerability - Reference: CVE-2021-44228 #753
• ...

cc: @TechByTom, @mpexo, @jvkassi, @mjmeijerman.

[Neustradamus]

• Bouncy Castle CVEs: Bouncy Castle 1.70 (2021-11-29) instead of 1.54 (CVEs) #562 + Bouncy Castle 1.67 instead of 1.54 (#562) #564 + Bump bcprov-jdk15on from 1.54 to 1.67 in /m2 #741
• slf4j CVE: Update slf4j to 1.7.32 (CVE-2018-8088) #667
• log4j CVEs: log4j CVEs #754 + log4j Vulnerability - Reference: CVE-2021-44228 #753
• ...

cc: @TechByTom, @mpexo, @jvkassi, @mjmeijerman.

[Neustradamus]

@JonathanLennox, @sawall, @nils-ohlmeier: After a long time, there are changes for security etc.!
All are not up-to-date, but better, thanks!

jitsi

• https://github.com/jitsi/jitsi
• https://github.com/jitsi/jitsi/blob/master/pom.xml
• build(deps): bump bcprov-jdk18on from 1.72 to 1.74 #803
• CVE fixes? #745
• Bump bcprov-jdk15on from 1.54 to 1.67 in /m2 #741
• Bouncy Castle 1.67 instead of 1.54 (#562) #564
• Bouncy Castle 1.70 (2021-11-29) instead of 1.54 (CVEs) #562
• Update to BC 1.51 left som references to 1.50 #43

libjitsi

• https://github.com/jitsi/libjitsi
• https://github.com/jitsi/libjitsi/blob/master/pom.xml
• Bump bouncycastle again, to 1.75; bump jitsi-srtp to pull in dependency update as well. libjitsi#568
• Bump bcprov-jdk18on from 1.71 to 1.74 libjitsi#567
• Bump bcprov-jdk15on from 1.54 to 1.67 libjitsi#550
• Move SRTP core implementation to jitsi-srtp package (v2) libjitsi#528
• Bouncy Castle 1.65 instead of 1.54 libjitsi#522
• DTLS 1.2 handshake Alert Protocol Version libjitsi#444
• DTLS 1.2 support is missing libjitsi#441
• Update boncycastle from 1.51 to 1.54 libjitsi#128
• Update boncycastle from 1.51 to 1.54 libjitsi#72

jibri

• https://github.com/jitsi/jibri
• https://github.com/jitsi/jibri/blob/master/pom.xml
• Bump BouncyCastle to version 1.75. jibri#514

zrtp4j

• https://github.com/jitsi/zrtp4j
• https://github.com/jitsi/zrtp4j/blob/master/pom.xml
• Update bouncycastle from 1.48 to 1.64 zrtp4j#3

jitsi-videobridge

• https://github.com/jitsi/jitsi-videobridge
• https://github.com/jitsi/jitsi-videobridge/blob/master/pom.xml
• https://github.com/jitsi/jitsi-videobridge/blob/master/jitsi-media-transform/pom.xml
• Bump Bouncycastle to version 1.75. jitsi-videobridge#2036
• Cleanup DTLS 1.0 leftovers jitsi-videobridge#1983
• fix: Bumps jitsi-media-transform, BC 1.70 and fix support for DTLS 1.0. jitsi-videobridge#1884
• BouncyCastle update to > 1.68 jitsi-videobridge#1881
• DTLS 1.2/DTLS server role support/BC 1.61 jitsi-videobridge#806
• Update bcprov-jdk15on to 1.54 jitsi-videobridge#123

moderated-meetings

• https://github.com/jitsi/moderated-meetings
• https://github.com/jitsi/moderated-meetings/blob/master/pom.xml
• update a couple old libs, fix the copy icon moderated-meetings#13
• build(deps): bump bcprov-jdk15on from 1.65.01 to 1.67 moderated-meetings#7

jigasi

• https://github.com/jitsi/jigasi
• https://github.com/jitsi/jigasi/blob/master/pom.xml
• chore(deps): bump bcprov-jdk15on from 1.54 to 1.67 jigasi#376
• Update Bouncy Castle to 1.70 jigasi#259

jitsi-srtp

• https://github.com/jitsi/jitsi-srtp
• https://github.com/jitsi/jitsi-srtp/blob/master/pom.xml
• Bump bouncycastle version to 1.75. jitsi-srtp#47
• Bump bcprov-jdk18on from 1.71 to 1.74 jitsi-srtp#46
• Bump bcprov-jdk15on from 1.66 to 1.67 jitsi-srtp#33
• Adjust SRTP crypto in non-OpenSSL cases. jitsi-srtp#19

otr4j

• https://github.com/jitsi/otr4j
• https://github.com/jitsi/otr4j/blob/master/pom.xml
• Bump bcprov-jdk15on from 1.65 to 1.67 otr4j#10
• Remove bc otr4j#5

OLD:

jitsi-media-transform (Integrated in jitsi-videobridge)

• https://github.com/jitsi/jitsi-media-transform
• https://github.com/jitsi/jitsi-media-transform/blob/master/pom.xml
• Upgrade to BC 1.70 and fix support for DTLS 1.0 jitsi-media-transform#413
• Rolling bouncycastle back to 1.68 to avoid jigasi breakage jitsi-media-transform#412
• Bump bouncycastle.version from 1.65 to 1.68 jitsi-media-transform#346
• Bouncy Castle 1.65 instead of 1.61 jitsi-media-transform#253
• Dtls 1.2/Dtls server/BC 1.61 jitsi-media-transform#43
• DO NOT MERGE: Dtls 1.2/Bouncycastle update jitsi-media-transform#3

jitsi-hammer

• https://github.com/jitsi/jitsi-hammer
• https://github.com/jitsi/jitsi-hammer/blob/master/pom.xml
• Need an update of Bouncy Castle 1.51 -> 1.65 jitsi-hammer#36
• Adding project files for NetBeans IDE jitsi-hammer#1

bccontrib

• https://github.com/jitsi/bccontrib
• https://github.com/jitsi/bccontrib/blob/master/pom.xml
• Dependency updates bccontrib#3

jitsi-universe-public

• https://github.com/jitsi/jitsi-universe-public
• https://github.com/jitsi/jitsi-universe-public/blob/master/pom.xml
• Bouncy Castle to 1.61 #1 jitsi-universe-public#2
• Bouncy Castle to 1.61 for resolve vulns... jitsi-universe-public#1

[Neustradamus]

Currently not up-to-date:

• BouncyCastle update moderated-meetings#33
• BouncyCastle update otr4j#11
• BouncyCastle update zrtp4j#7

[Neustradamus]

Bouncy Castle has a new release: 1.76:

• https://bouncycastle.org/latest_releases.html
• https://bouncycastle.org/releasenotes.html#r1rv76

cc: @JonathanLennox, @sawall, @nils-ohlmeier