Open bhargavyk2002 opened 3 months ago
Hi, Anchore scan has detected 3 vulnerabilities from the package 'org.bouncycastle', These are being flagged as High severity even though no vulnerability score is present in NVD database.
These packages are present in ksql as a dependency org.bouncycastle:bcprov-jdk18on:jar bouncycastle:bcpkix-jdk18on:jar
The mitigation is to upgrade to the fixed version i.e. 1.78 Are there any plans to upgrade these packages?
@bhargavyk2002 Thank you for this issue. Those issues will be addressed in the quarterly patch release in Q2 2024
Hi, Anchore scan has detected 3 vulnerabilities from the package 'org.bouncycastle', These are being flagged as High severity even though no vulnerability score is present in NVD database.
These packages are present in ksql as a dependency org.bouncycastle:bcprov-jdk18on:jar bouncycastle:bcpkix-jdk18on:jar
The mitigation is to upgrade to the fixed version i.e. 1.78 Are there any plans to upgrade these packages?