(only test scope): bcprov-jdk15on package version 1.60 is vulnerable to CVE-2020-15522

[Abderrahman-byte]

bcprov-jdk15on package must be updated to version 1.70

[wvandermerwe]

@patrickfav Hi there, is this lib still being maintained?

[patrickfav]

Hi,

First, thanks for reporting the CVE!

However, this is a non-issue since bcprov-jdk15on is ONLY used in the TEST scope and is not a dependency during runtime. The test is also just check if the output is compatible with the output of bouncy castle (a regression test so to speak).

I will soon update all the dependencies, therefore also this dependency (need to migrate away from Jcenter).

[patrickfav]

This warning is now fixed with 0.10.0