Please consider upgrading three dependencies to mitigate several known CVEs

[sethb3214]

Dependency vulnerability analysis shows that there are three dependencies in this project that appear to contain known CVEs. The dependencies are

• bcprov-jdk15on-1.51.jar
• cxf-rt-transports-http-3.1.2.jar
• cxf-rt-ws-security-3.1.2.jar

Here are the Bouncy Castle CVEs:

• CVE-2018-1000613
• CVE-2016-1000340
• CVE-2016-1000342
• CVE-2016-1000343
• CVE-2016-1000344
• CVE-2016-1000352
• CVE-2016-1000341
• CVE-2016-1000345
• CVE-2016-1000339
• CVE-2016-1000346

Here are the Apache CXF Transport CVEs:

• CVE-2018-8039
• CVE-2016-6812

Here is the WS Security CVE:

• CVE-2017-5656

While these libraries don't appear to be used by the Java FuelSDK, is it possible to upgrade these dependencies to a more secure version?