search

box / box-java-sdk

The Box SDK for Java.
http://opensource.box.com/box-java-sdk/
Apache License 2.0
156 stars 185 forks source link

Vulnerability via dependent org.bouncycastle/bcprov-jdk15on < 1.60 #1221

Closed ittzik closed 9 months ago

ittzik commented 10 months ago

Description of the Issue version used is < 1.60 and is vulnerable. See https://nvd.nist.gov/vuln/detail/CVE-2018-1000613 , from looking at https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on, looks like the minimal non-vulnerable version is 1.74 at the moment (1.77 is the latest)

Please upgrade to version 1.60 or higher.

Versions Used Java SDK: 4.6.1 Java: openjdk version "17"

Steps to Reproduce N/A

Error Message, Including Stack Trace N/A

arjankowski commented 10 months ago

Hi @ittzik , We know about the CVE vulnerabilities but we cannot upgrade those versions.

We have customers who rely on FIPS (Federal Information Processing Standards) certification. There are few version of Bouncycastle implementations that are FIPS 140-2 certified and they work with older versions of bcprov-jdk15on and bcpkix-jdk15on for Java 11 this will be 1.57.

If you need newer Bouncycastle libraries I recommend excluding them from our SDK and providing them yourself as you have this described here https://github.com/box/box-java-sdk?tab=readme-ov-file#fips-140-2-compliance

apupier commented 10 months ago

From https://www.bouncycastle.org/fips_java_roadmap.html , there is a newer certified version https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4616

If i understand well, by looking to the corresponding release dates from the FIPS Java Bouncycastle release notes https://www.bouncycastle.org/fips-java/RELEASE_NOTES.md , the latest certified version is https://mvnrepository.com/artifact/org.bouncycastle/bcpkix-jdk18on/1.72 https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on/1.72

stale[bot] commented 9 months ago

This issue has been automatically marked as stale because it has not been updated in the last 30 days. It will be closed if no further activity occurs within the next 7 days. Feel free to reach out or mention Box SDK team member for further help and resources if they are needed.

stale[bot] commented 9 months ago

This issue has been automatically closed due to maximum period of being stale. Thank you for your contribution to Box Java SDK and feel free to open another PR/issue at any time.