You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[java-bigquery] Move to google-api-client 2.9.2: bundled trust store includes AAA Certificate Services (eMudhra CA compromise) #14755
google-cloud-bigquery 2.73.0 depends on google-api-client 2.7.2. google-cloud-bigquery-jdbc 1.6.0 declares the same version, and its :all jar shades it under com/google/bqjdbc/shaded/ (checked on 1.0.0). The bundled google.p12, which GoogleUtils.getCertificateTrustStore() loads, and google.jks each hold 70 certificates. They include CN=AAA Certificate Services, one of the roots affected by the eMudhra intermediate CA compromise (GHSA-6q48-6c7w-9gw2).
google-api-client 2.9.2 removes that root from both stores, and its getCertificateTrustStore() now prefers the JDK trust store. Could the next google-cloud-bigquery and google-cloud-bigquery-jdbc releases move to 2.9.2 or later? If the version comes from the shared dependencies BOM, I'm happy to file this there instead.
Activity
lqiu96 commentedon Oct 23, 2026
Thanks for the report. We are actively working on migrating this over to a new version to resolve the vulnerability. CC: @blakeli0
lqiu96 commentedon Oct 28, 2026
Ah it looks like it was already handled in #14725. Closing this out