chore: updates bouncy castle to 1.75 (latest 1.7x) #741
Conversation
kebeda
changed the title
|
@thinkingserious @twilio-dx can someone look into this? |
|
Please mitigate this vulnerability by updating Bouncy Castle |
|
Latest is now 1.76 which fixes an additional vulnerability. |
| <artifactId>bcprov-jdk15on</artifactId> | ||
| <version>1.70</version> | ||
| <artifactId>bcprov-jdk18on</artifactId> | ||
| <version>1.75</version> |
There was a problem hiding this comment.
| <version>1.75</version> | |
| <version>1.76</version> |
There was a problem hiding this comment.
@rakatyal @shrutiburman please commit this change and merge this PR to fix the CVE vulnerability
|
Any update on this? |
|
I'm also interested in updates on this, would love to resolve this CVE in my project. Thanks in advance! |
|
Please mitigate this vulnerability by updating Bouncy Castle |
|
Might make sense for maintainers to create a fresh pr for fix |
|
Th last commit on main branch was Jan 3. Why the need for a new PR? |
|
@shrutiburman this was merged with 1.75 instead of 1.76, the latest bouncycastle version -- will there be a separate pull request to update the latest? |
|
@shrutiburman opened a PR here #744 |
|
Oh, thanks @mrdziuban for the PR. I'll merge that once all runs are passing. |
|
Done. |
This mitigates CVE-2023-33201.
ref. https://github.com/bcgit/bc-java/wiki/CVE-2023-33201