bcpkix-jdk15on vulnerability for CVE-2022-21449

[prashil-g]

I used https://github.com/jfrog/jfrog-CVE-2022-21449 to check for our microservice and found that bcpkix-jdk15on might be vulnerable. Can you please confirm which version should we upgrade to if available for this CVE?

In build/libs/<microservice>.jar/BOOT-INF/lib/bcpkix-jdk15on-1.70.jar/org/bouncycastle/eac/operator/jcajce/EACHelper.class: potential use of ECDSA - may be vulnerable In build/libs/<microservice>.jar/BOOT-INF/lib/bcpkix-jdk15on-1.70.jar/org/bouncycastle/eac/operator/jcajce/JcaEACSignerBuilder.class: potential use of ECDSA - may be vulnerable In build/libs/<microservice>.jar/BOOT-INF/lib/bcpkix-jdk15on-1.70.jar/org/bouncycastle/its/jcajce/JcaITSContentSigner.class: potential use of ECDSA - may be vulnerable In build/libs/<microservice>.jar/BOOT-INF/lib/bcpkix-jdk15on-1.70.jar/org/bouncycastle/its/jcajce/JcaITSContentVerifierProvider.class: potential use of ECDSA - may be vulnerable In build/libs/<microservice>.jar/BOOT-INF/lib/jjwt-0.9.1.jar/io/jsonwebtoken/SignatureAlgorithm.class: potential use of ECDSA - may be vulnerable In build/libs/<microservice>.jar/BOOT-INF/lib/bcprov-jdk15on-1.70.jar/org/bouncycastle/jcajce/BCFKSLoadStoreParameter$Builder.class: potential use of ECDSA - may be vulnerable In build/libs/<microservice>.jar/BOOT-INF/lib/bcprov-jdk15on-1.70.jar/org/bouncycastle/jcajce/BCFKSLoadStoreParameter$SignatureAlgorithm.class: potential use of ECDSA - may be vulnerable In build/libs/<microservice>.jar/BOOT-INF/lib/bcprov-jdk15on-1.70.jar/org/bouncycastle/jcajce/provider/asymmetric/EC$Mappings.class: potential use of ECDSA - may be vulnerable In build/libs/<microservice>.jar/BOOT-INF/lib/bcprov-jdk15on-1.70.jar/org/bouncycastle/jcajce/provider/asymmetric/x509/X509SignatureUtil.class: potential use of ECDSA - may be vulnerable In build/libs/<microservice>.jar/BOOT-INF/lib/bcprov-jdk15on-1.70.jar/org/bouncycastle/jcajce/provider/keystore/bcfks/BcFKSKeyStoreSpi.class: potential use of ECDSA - may be vulnerable In build/libs/<microservice>.jar/BOOT-INF/lib/bcprov-jdk15on-1.70.jar/org/bouncycastle/jce/provider/X509SignatureUtil.class: potential use of ECDSA - may be vulnerable

[peterdettman]

bcpkix uses "ECDSA" from other installed cryptographic providers. It is the implementation of ECDSA within the JDK/JRE class libraries that is vulnerable (specifically the SunEC provider).

You should just update to the appropriate JDK/JRE update. Technically you should not be vulnerable anyway if you are using the BC provider, either explicitly via the API or by default with the BC provider installed at higher priority than SunEC. However provider configurations are somewhat error-prone so I would not risk having the broken ECDSA implementation around.

[dghgit]

Closing as now resolved.