#345 Fix Trivy CRITICAL findings by upgrading vulnerable spring-security, thymeleaf and bouncycastle jars

Author: henry-bobka

CHANGELOG.md

@@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 ### Fixed
 - [#345] Fixed a regression of [#163] where password-reset mails were silently dropped for e-mail addresses without a real TLD (e.g. `admin@ces.local`), because the CES password-management service was no longer registered after the CAS 7 / Spring Boot 3 upgrade.
+- [#345] Fixed Trivy CRITICAL findings by upgrading vulnerable transitive dependencies bundled in the base CAS webapp WAR:
+  - [CVE-2026-22732](https://nvd.nist.gov/vuln/detail/CVE-2026-22732) – spring-security 6.5.5 → 6.5.9
+  - [CVE-2026-40477](https://nvd.nist.gov/vuln/detail/CVE-2026-40477) / [CVE-2026-40478](https://nvd.nist.gov/vuln/detail/CVE-2026-40478) / [CVE-2026-41901](https://nvd.nist.gov/vuln/detail/CVE-2026-41901) – thymeleaf and thymeleaf-spring6 3.1.3.RELEASE → 3.1.5.RELEASE
+  - [CVE-2025-14813](https://nvd.nist.gov/vuln/detail/CVE-2025-14813) – bouncycastle bcprov/bcpkix/bcutil-jdk18on 1.82 → 1.84
 
 ## [v7.3.7-2] - 2026-07-02
 ### Added

app/build.gradle

@@ -81,6 +81,10 @@ configurations.configureEach {
         cacheChangingModulesFor 0, "seconds"
         cacheDynamicVersionsFor 0, "seconds"
         preferProjectModules()
+        // CVE-2025-14813: forced because the CAS BOM (enforcedPlatform) pins 1.82.
+        force "org.bouncycastle:bcprov-jdk18on:1.84"
+        force "org.bouncycastle:bcpkix-jdk18on:1.84"
+        force "org.bouncycastle:bcutil-jdk18on:1.84"
         def failIfConflict = project.hasProperty("failOnVersionConflict") && Boolean.valueOf(project.getProperty("failOnVersionConflict"))
         if (failIfConflict) {
             failOnVersionConflict()
@@ -221,6 +225,10 @@ dependencies {
     implementation "org.apereo.cas:cas-server-support-gauth-core-mfa:${project.'cas.version'}"
     implementation "org.apereo.cas:cas-server-support-otp-mfa-core:${project.'cas.version'}"
     implementation "org.apereo.cas:cas-server-core-notifications:${project.'cas.version'}"
+
+    // Patched thymeleaf (3.1.5.RELEASE via thymeleaf.version) onto the classpath; see gradle.properties.
+    implementation "org.thymeleaf:thymeleaf"
+    implementation "org.thymeleaf:thymeleaf-spring6"
 }
 
 configurations.all {

app/gradle.properties

@@ -13,6 +13,12 @@ tomcatVersion=11.0.22
 
 commons-lang3.version=3.19.0
 
+# Trivy CRITICAL fixes; old copies in the base CAS WAR are excluded in springboot.gradle.
+# CVE-2026-22732
+spring-security.version=6.5.9
+# CVE-2026-40477 / CVE-2026-40478 / CVE-2026-41901
+thymeleaf.version=3.1.5.RELEASE
+
 # Use -jetty, -undertow to other containers
 # Or blank if you want to deploy to an external container
 appServer=-tomcat

app/gradle/springboot.gradle

@@ -123,7 +123,21 @@ bootWar {
                     "WEB-INF/lib/servlet-api-6*.jar",
                     "WEB-INF/lib/jakarta.servlet-api-*.jar",
                     "WEB-INF/lib/tomcat-servlet-api-*.jar",
-                    "WEB-INF/lib/jaxws-rt-*.jar"
+                    "WEB-INF/lib/jaxws-rt-*.jar",
+                    // Trivy CRITICAL fixes: drop the base WAR's vulnerable jars, keeping the patched
+                    // versions from this overlay's classpath (see gradle.properties / build.gradle).
+                    // CVE-2026-22732
+                    "WEB-INF/lib/spring-security-config-*.jar",
+                    "WEB-INF/lib/spring-security-core-*.jar",
+                    "WEB-INF/lib/spring-security-crypto-*.jar",
+                    "WEB-INF/lib/spring-security-web-*.jar",
+                    // CVE-2026-40477/40478/41901
+                    "WEB-INF/lib/thymeleaf-3*.jar",
+                    "WEB-INF/lib/thymeleaf-spring6-*.jar",
+                    // CVE-2025-14813
+                    "WEB-INF/lib/bcprov-jdk18on-*.jar",
+                    "WEB-INF/lib/bcpkix-jdk18on-*.jar",
+                    "WEB-INF/lib/bcutil-jdk18on-*.jar"
             ]
         }
     }