Please update Bouncy Castle

[Neustradamus]

Please update Bouncy Castle

• https://www.bouncycastle.org/
• https://www.bouncycastle.org/releasenotes.html
• http://www.bouncycastle.org/latest_releases.html
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncy%20castle
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncycastle
• https://www.cvedetails.com/vulnerability-list/vendor_id-7637/Bouncycastle.html

[Neustradamus]

Any news?

• https://github.com/aws/aws-dynamodb-encryption-java/blob/master/pom.xml#L87
• https://github.com/aws/aws-dynamodb-encryption-java/blob/master/sdk1/pom.xml#L151

[Neustradamus]

Linked to:

• There is a vulnerability in bcprov 1.65,upgrade recommended aws-encryption-sdk-java#233

[lavaleri]

Thank you for the report.

We have confirmed that the AWS DynamoDB Encryption Client does not use the impacted code, and only uses BouncyCastle as a test dependency. We are planning on upgrading this dependency to the latest version as part of our next release.

I will update and close this ticket once we have released with the upgraded dependency.

[lavaleri]

Bouncy Castle was upgraded to 1.68 as of the 1.15.0 release. Thank you!

[Neustradamus]

@lavaleri: Good job, thanks!

At the same time, can you update to 1.69?