spring-cloud-commons usage of bcprov-jdk18on 1.81.1 with CVE

[gonmmarques]

Hello,

There is this CVE that impacts BouncyCastle. I know there are already fixes available, my question is actually pretty similar to this issue, in short Spring Cloud cannot upgrade BouncyCastle as is, see #2293 (comment),, but if the CVE fix was backported to 1.81.x they would be able to upgrade I believe.

Could you check if the fix could be backported? Is this feasible?

Thanks.

[dghgit]

I'm confused, the CVE says "This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84." 1.81.1 already has the patch.

Actually, I'd also appreciate it if you would let them we recommend updating to 1.85 as soon as possible.

[gonmmarques]

Yes, it is a bit confusing for myself as well but according to our scanners basically 1.81.1 is affected and suggests that this is fixed in dc75309

[dghgit]

The scanners are wrong and should be fixed. You are correct about there being an issue, but it is not with BC or Spring.

[gonmmarques]

OK thanks for the clarification @dghgit