CVE vulnerabilities reported in BouncyCastle jars

[jchirantan]

Hi @jouniaro

CVE-2024-30171 - Medium Severity Vulnerability reported on the bouncycastle jars:

• bcpkix-jdk15to18

<dependency>
  	<groupId>org.bouncycastle</groupId>
  	<artifactId>bcpkix-jdk15to18</artifactId>
  	<version>1.64</version>
  	<optional>true</optional>
 </dependency>

Dependent libraries:

• bcprov-jdk15to18
• bcutil-jdk15to18

Is there any plan to upgrade the dependency?

[jouniaro]

Thanks for the note. I guess it would be good to update the dependency. In general, the stack does not depend to a specific version of BC and you can always use a later version in practice. But, I will update it.