hyperledger-web3j/web3j

Critical Security Severity on 4.9.4

Boldbayar opened this issue · 2 comments

Boldbayar commented

Hello, I have found the following security issue by scanning with snyk

Provides transitive vulnerable dependency org.bouncycastle:bcprov-jdk15on:1.68

  1. https://advisory.checkmarx.net/advisory/vulnerability/Cxa9261daf-3755/ on dependency
jjanczur commented

I see it as well. You can probably fix it by forcing maven/Gradle to use a higher version of the bouncy castle in properties (similarly to upgrading log4j lib - CVE-2021-45105 ) but I don't know if it won't break the library/tests.

  • 👍1
mohamedelshami commented

@Boldbayar thank you for this finding, we will look into possibly adding a dependency override.

  • 🎉1
  • ❤️1