org.bouncycastle:bcprov-jdk15on vulnerability detected

[Roberto Perez Alcolea]

Hi folks,

From: https://snyk.io/vuln/SNYK-JAVA-ORGBOUNCYCASTLE-32412

Affected versions of this package are vulnerable to Unexpected Code Execution via the XMSS/XMSS^MT private key deserialization. A handcrafted private key could include references to unexpected classes which would be picked up from the class path for the executing application.

The recommendation is to use 1.60 at least.

This library uses PGPSecretKeyRingCollection(InputStream in) which is deprecated in 1.50-1.51 (https://github.com/bcgit/bc-java/blob/r1rv51/pg/src/main/java/org/bouncycastle/openpgp/PGPSecretKeyRingCollection.java#L48) and removed in 1.60 and 1.62 https://github.com/bcgit/bc-java/blob/r1rv62/pg/src/main/java/org/bouncycastle/openpgp/PGPSecretKeyRingCollection.java

Any chance you could do the adjustment soon?

Thanks

[Roberto Perez Alcolea]

@craigwblake, I believe #144 should take care of this

[Andrew]

Any ETA on releasing v1.2.9 with this fix?

[Daniel]

Any ETA on releasing v1.2.9 with this fix?

Seconded! :)

This is also causing issues when using other gradle plugins that depend on newer 1.60+ versions of bouncycastle modules. Gradle's default dependency resolution of using the newest version (assuming that the libraries are backwards compatible) doesn't work in this case because the PGPSecretKeyRingCollection(InputStream in) method was removed.

[Craig W. Blake]

Should be able to get a new release out today.

[Daniel]

Should be able to get a new release out today.

Wonderful! Thank you so much!

[Roberto Perez Alcolea]

Thank you for the release @craigwblake 👍 you 🎸