patrickfav/bcrypt

(only test scope): bcprov-jdk15on package version 1.60 is vulnerable to CVE-2020-15522

Abderrahman-byte opened this issue · 3 comments

Abderrahman-byte commented

bcprov-jdk15on package must be updated to version 1.70

wvandermerwe commented

@patrickfav Hi there, is this lib still being maintained?

patrickfav commented

Hi,

First, thanks for reporting the CVE!

However, this is a non-issue since bcprov-jdk15on is ONLY used in the TEST scope and is not a dependency during runtime.
The test is also just check if the output is compatible with the output of bouncy castle (a regression test so to speak).

Screenshot 2022-09-11 130047

I will soon update all the dependencies, therefore also this dependency (need to migrate away from Jcenter).

  • 👍2
patrickfav commented

This warning is now fixed with 0.10.0