Skip to content

Fix CVE-2026-64607, CVE-2026-54399 #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
runeflobakk merged 3 commits into from
Aug 18, 2026
Merged

Fix CVE-2026-64607, CVE-2026-54399 #42

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7daa96c
Fix CVE-2026-64607, CVE-2026-54399
runeflobakk Aug 17, 2026
ed89d2f
Remove invalid test
runeflobakk Aug 17, 2026
5fc409c
Reenable previously failing Commfides OCSP test
runeflobakk Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,14 +48,14 @@
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bc-jdk18on-bom</artifactId>
<version>1.84</version>
<version>1.85.2</version>
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>org.junit</groupId>
<artifactId>junit-bom</artifactId>
<version>5.14.0</version>
<version>5.14.4</version>
<type>pom</type>
<scope>import</scope>
</dependency>
Expand All @@ -69,7 +69,7 @@
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-bom</artifactId>
<version>2.0.17</version>
<version>2.0.18</version>
<type>pom</type>
<scope>import</scope>
</dependency>
Expand All @@ -94,12 +94,12 @@
<dependency>
<groupId>org.apache.httpcomponents.client5</groupId>
<artifactId>httpclient5</artifactId>
<version>5.5.1</version>
<version>5.6.4</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents.core5</groupId>
<artifactId>httpcore5</artifactId>
<version>5.3.6</version>
<version>5.4.3</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
Expand All @@ -113,13 +113,13 @@
<dependency>
<groupId>no.digipost</groupId>
<artifactId>digg</artifactId>
<version>0.38</version>
<version>0.39</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>commons-io</groupId>
<artifactId>commons-io</artifactId>
<version>2.20.0</version>
<version>2.22.0</version>
<scope>test</scope>
</dependency>
<dependency>
Expand Down
40 changes: 0 additions & 40 deletions src/test/java/no/digipost/security/cert/RealOCSPCertificateValidatorTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@
import no.digipost.security.HttpClient;
import no.digipost.time.ControllableClock;
import org.apache.hc.core5.http.HttpHost;
import org.junit.jupiter.api.Disabled;
import org.junit.jupiter.api.Test;

import java.security.cert.X509Certificate;
Expand Down Expand Up @@ -53,7 +52,6 @@ void validerer_gammelt_commfides_sertifikat() {
}

@Test
@Disabled // Something's wrong with the certificate. OCSP lookup has started failing.
void unknown_ocsprespone_gir_undecided_for_nytt_commfides_sertifikat() {
X509Certificate commfidesSert = NYTT_COMMFIDES_SERTIFIKAT_KS;

Expand All @@ -74,14 +72,6 @@ void godtar_nytt_commfides_test_sertifikat() {
assertThat(validatorQaEnv.validateCert(EBOKS_COMMFIDES_TEST), is(OK));
}


@Test
void validerer_nytt_buypass_sertifikat() {
X509Certificate buypassSert = DigipostSecurity.readCertificate(BUYPASS_MF_PROD_SERTIFIKAT.getBytes());

assertThat(validator.validateCert(buypassSert), is(OK));
}

private static final X509Certificate EBOKS_COMMFIDES_TEST = DigipostSecurity.readCertificate((
"-----BEGIN CERTIFICATE-----\n" +
"MIIGgDCCBWigAwIBAgIIXWattKnFcDswDQYJKoZIhvcNAQELBQAwgfMxPTA7BgNV\n" +
Expand Down Expand Up @@ -202,36 +192,6 @@ void validerer_nytt_buypass_sertifikat() {
"nCZizViRMZDueNce+J26mOi60dxJjQc8du2ZCmAyQzOcCguQANUR\n" +
"-----END CERTIFICATE-----";

private static final String BUYPASS_MF_PROD_SERTIFIKAT =
"-----BEGIN CERTIFICATE-----\n" +
"MIIE1DCCA7ygAwIBAgILC0banYlr12VQNoQwDQYJKoZIhvcNAQELBQAwSzELMAkG\n" +
"A1UEBhMCTk8xHTAbBgNVBAoMFEJ1eXBhc3MgQVMtOTgzMTYzMzI3MR0wGwYDVQQD\n" +
"DBRCdXlwYXNzIENsYXNzIDMgQ0EgMzAeFw0xNzA2MDExMjMwMDhaFw0yMDA2MDEy\n" +
"MTU5MDBaMGgxCzAJBgNVBAYTAk5PMRgwFgYDVQQKDA9QT1NURU4gTk9SR0UgQVMx\n" +
"ETAPBgNVBAsMCERpZ2lwb3N0MRgwFgYDVQQDDA9QT1NURU4gTk9SR0UgQVMxEjAQ\n" +
"BgNVBAUTCTk4NDY2MTE4NTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\n" +
"AKgYMYMfkSkPi/njmKkAhWDoNgy/5MXlfRYw02bvknbDiOTJPOQrDqSg4g5BsOuL\n" +
"XnjcLueNdVSiqwdt+EnDtbdE6BphDf1et2vJfDSpTrn5z7NRBmOrAKpX9V9/1H2M\n" +
"liSBxdMgKDACfYmPi8TBShUOWOB2JUW9u6noUdx+vB3ZjUTzaiDtPnU1gqM8E+eY\n" +
"KIGW6wpBdiPuBMXXGlS03bJ5ztyilqCyvpKY4I7T8XX5fR+C10avMHfHZKkscFku\n" +
"Ha6yY70Audr5TIXnp/sLJTgYEsKXd3UYHQg/4iZ/YpGqgZuPGUBQl7urpKvsFHWL\n" +
"3dERM7PMVMctAyPXTWg+HRUCAwEAAaOCAZowggGWMAkGA1UdEwQCMAAwHwYDVR0j\n" +
"BBgwFoAUzMP4B7ecbXpO9acrHQX5s0cckdEwHQYDVR0OBBYEFP7h5beQE8Xi8Yd8\n" +
"zppcYDtzSel+MA4GA1UdDwEB/wQEAwIEsDAVBgNVHSAEDjAMMAoGCGCEQgEaAQMC\n" +
"MIGlBgNVHR8EgZ0wgZowL6AtoCuGKWh0dHA6Ly9jcmwuYnV5cGFzcy5uby9jcmwv\n" +
"QlBDbGFzczNDQTMuY3JsMGegZaBjhmFsZGFwOi8vbGRhcC5idXlwYXNzLm5vL2Rj\n" +
"PUJ1eXBhc3MsZGM9Tk8sQ049QnV5cGFzcyUyMENsYXNzJTIwMyUyMENBJTIwMz9j\n" +
"ZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0MHoGCCsGAQUFBwEBBG4wbDAzBggrBgEF\n" +
"BQcwAYYnaHR0cDovL29jc3AuYnV5cGFzcy5uby9vY3NwL0JQQ2xhc3MzQ0EzMDUG\n" +
"CCsGAQUFBzAChilodHRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQQ2xhc3MzQ0Ez\n" +
"LmNlcjANBgkqhkiG9w0BAQsFAAOCAQEAcE7jlA1Y9K7tF5E3nUvrfC8amXKN8K/H\n" +
"joy9QJMw8pafGm/tnIoKjAR7/5Lvc2SSw6VKtKWqVr/sVHlbvHRtZe0zyyja15a/\n" +
"0+wiI8TRoePPLXztacb398myoZBPnJKKdQdOmIQtoRPb7lcrwFzT5TIsiliSZshA\n" +
"rfE1ns/o/TrcClI7FvxBbwUF0kDGSh1jkh2v26ioc+Hvs3Yxf19xspFVDPZ+01Z4\n" +
"0XDY2XdsA4pkeJdvieeyZ2q2RGXxLEVcftlOLm2Mgthf+fRLEKUeBsXfLqDEKpca\n" +
"V4WRqeRSKdtXWz6TdsDT3jazcuk1fzcFlhek6ez0JmO/ePI92s0O2w==\n" +
"-----END CERTIFICATE-----";

@SuppressWarnings("unused")
private static final String BUYPASS_MF_TEST_SERTIFIKAT =
"-----BEGIN CERTIFICATE-----\n" +
Expand Down
Loading