Skip to content

[java-bigquery] Move to google-api-client 2.9.2: bundled trust store includes AAA Certificate Services (eMudhra CA compromise) #14755

Closed

Description

@o-shevchenko

google-cloud-bigquery 2.73.0 depends on google-api-client 2.7.2. google-cloud-bigquery-jdbc 1.6.0 declares the same version, and its :all jar shades it under com/google/bqjdbc/shaded/ (checked on 1.0.0). The bundled google.p12, which GoogleUtils.getCertificateTrustStore() loads, and google.jks each hold 70 certificates. They include CN=AAA Certificate Services, one of the roots affected by the eMudhra intermediate CA compromise (GHSA-6q48-6c7w-9gw2).

google-api-client 2.9.2 removes that root from both stores, and its getCertificateTrustStore() now prefers the JDK trust store. Could the next google-cloud-bigquery and google-cloud-bigquery-jdbc releases move to 2.9.2 or later? If the version comes from the shared dependencies BOM, I'm happy to file this there instead.

Activity

  1. lqiu96 commented on Oct 23, 2026

    @lqiu96
    Member

    Thanks for the report. We are actively working on migrating this over to a new version to resolve the vulnerability. CC: @blakeli0

  2. added
    type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.
    priority: p1Important issue which blocks shipping the next release. Will be fixed prior to next release.
    on Oct 23, 2026
  3. lqiu96 commented on Oct 28, 2026

    @lqiu96
    Member

    Ah it looks like it was already handled in #14725. Closing this out

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    priority: p1Important issue which blocks shipping the next release. Will be fixed prior to next release.type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions