Upgrade "bcprov-jdk15on" to version 1.61 or higher to get rid of security vulnerability [CVE-2018-1000613, CWE-502], [CVE-2020-26939, CWE-200], [CVE-2018-1000180, CWE-573], [CVE-2020-15522, CWE-208]

[aaron-kumar]

SAST tool reported vulnerability for library : bcprov-jdk15on

network.oxalis:[email protected]
---org.bouncycastle:[email protected]
------org.bouncycastle:[email protected]

network.oxalis:[email protected]
---network.oxalis:[email protected]
------org.bouncycastle:[email protected]
---------org.bouncycastle:[email protected]

network.oxalis:[email protected]
---network.oxalis.vefa:[email protected]
------network.oxalis.vefa:[email protected]
---------no.difi.commons:[email protected]
------------net.klakegg.pkix:[email protected]
---------------org.bouncycastle:[email protected]
------------------org.bouncycastle:[email protected]

network.oxalis:[email protected]
---org.bouncycastle:[email protected]

Library "org.bouncycastle:bcprov-jdk15on" need to upgrade to version 1.61 or higher

Subtask of OxalisCommunity/Oxalis-internal-roadmap#13

[aaron-kumar]

Fixed in Oxalis with commit: fc22da14415882e5772dcb74fdc1d6609b74b137 (Oxalis-AS4 use provided version of Oxalis)

[johnksv]

Hi! Added this comment to the commit. Adding it here as well:

Just a heads up.
I think this bump breaks net.klakegg.pkix:[email protected], and thus detection of Mode (TEST/ PRODUCTION) based on certificate (network.oxalis.vefa.peppol.security.ModeDetector).
To fix this we require a new version of pkix-ocsp. I have created this PR: klakegg/pkix-ocsp#4 , and validated that pinning
pkix-ocsp to 0.9.2-SNAPSHOT indeed solves the problem. Even though it can be solved by pinning the version explicit in the pom, it should be fixed through the transitive dependencies.

Before:

network.oxalis:[email protected]
---network.oxalis.vefa:[email protected]
------network.oxalis.vefa:[email protected]
---------no.difi.commons:[email protected]
------------net.klakegg.pkix:[email protected]
---------------org.bouncycastle:[email protected]
------------------org.bouncycastle:[email protected]

cc @aaron-kumar

[aaron-kumar]

That's good catch @johnksv
Even though it should have been caught during release testing and fixed by explicitly using bumped up version but good that you are fixing it right place.
Thanks a lot for contribution !!!

[aaron-kumar]

Reopening until fix will also be available in dependency (klakegg/pkix-ocsp#4) release version

[aaron-kumar]

Fixed with Oxalis release: v5.4.0 and Oxalis-AS4 release: v5.4.0