Skip to content
This repository was archived by the owner on May 14, 2025. It is now read-only.

Update Bouncycastle to 1.78.1 for CVE-2023-33201#5804

Merged
onobc merged 1 commit intospring-attic:mainfrom
onobc:update-bouncycastle-fix-cve
May 9, 2024
Merged

Update Bouncycastle to 1.78.1 for CVE-2023-33201#5804
onobc merged 1 commit intospring-attic:mainfrom
onobc:update-bouncycastle-fix-cve

Conversation

@onobc
Copy link
Contributor

@onobc onobc commented May 9, 2024 •
edited
Loading

Resolves #5780

BEFORE

cbono@cbono-a01 spring-cloud-dataflow % ./mvnw dependency:tree -Dincludes='org.bouncycastle' | grep -E '1.73' | wc -l
      45

AFTER

cbono@cbono-a01 spring-cloud-dataflow % ./mvnw dependency:tree -Dincludes='org.bouncycastle' | grep -E '1.73' | wc -l
      0

cbono@cbono-a01 spring-cloud-dataflow % ./mvnw dependency:tree -Dincludes='org.bouncycastle' | grep -E '1.78.1' | wc -l
      45

@onobc onobc requested a review from corneil May 9, 2024 19:56
@onobc onobc mentioned this pull request May 9, 2024
Closed
corneil
corneil approved these changes May 9, 2024
View reviewed changes
Copy link
Contributor

@corneil corneil left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@onobc onobc merged commit 3b9cf4e into spring-attic:main May 9, 2024
@onobc onobc deleted the update-bouncycastle-fix-cve branch May 9, 2024 22:16
@corneil corneil added this to the 2.11.3 milestone May 17, 2024
@r-heimann
Copy link

r-heimann commented Jun 24, 2024 •
edited
Loading

@onobc is bcpkix / bcpkix-jdk18on the same bouncycastle that you updated? bcpkix-jdk18on is still on v1.75. Was this missed in this pr?
Reason i'm asking:

CVE-2024-29857 - org.bouncycastle:bcpkix-jdk18on
CVE-2024-30171 - org.bouncycastle:bcpkix-jdk18on
CVE-2024-30172 - org.bouncycastle:bcpkix-jdk18on
CVE-2024-34447 - org.bouncycastle:bcprov-jdk18on

@cppwfs
Copy link
Contributor

cppwfs commented Jun 24, 2024

@r-heimann Thank you for raising this issue. PR #5847 has been submitted to address this.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

1 more reviewer

@corneil corneil corneil approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Milestone

2.11.3

Development

Successfully merging this pull request may close these issues.

Vulnerabilities affecting Spring Cloud Dataflow dependencies

4 participants

@onobc @r-heimann @cppwfs @corneil