[ZOOKEEPER-3236] Upgrade BouncyCastle

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.6.0, 3.5.5
• Labels: pull-request-available
• Assignee: Colm O hEigeartaigh
• Reporter: Colm O hEigeartaigh
• Created: 07/Jan/19 16:48
• Updated: 20/May/19 17:50
• Resolved: 29/Jan/19 15:09

Description

BouncyCastle should be upgraded to the latest release. The current version we are picking up contains security advisories:

bcprov-jdk15on-1.56.jar (cpe:/a:bouncycastle:bouncy-castle-crypto-package:1.56, org.bouncycastle:bcprov-jdk15on:1.56, cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.56, cpe:/a:bouncycastle:bouncy_castle_crypto_package:1.56) : CVE-2017-13098, CVE-2018-1000180, CVE-2018-1000613

Issue Links

• links to: GitHub Pull Request #757