Upgrade to Bouncy Castle 1.78

tomitribe · Apr 16, 2024 · e94878f · e94878f
1 parent 2773cfa
commit e94878f
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 3 deletions.
diff --git a/server/openejb-client/pom.xml b/server/openejb-client/pom.xml
@@ -160,7 +160,7 @@
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcmail-jdk15to18</artifactId>
-      <version>1.75</version>
+      <version>1.78</version>
       <scope>test</scope>
     </dependency>
   </dependencies>

diff --git a/server/openejb-cxf/pom.xml b/server/openejb-cxf/pom.xml
@@ -101,7 +101,7 @@
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcprov-jdk15to18</artifactId>
-      <version>1.75</version>
+      <version>1.78</version>
     </dependency>
     <dependency>
       <groupId>org.apache.wss4j</groupId>

diff --git a/tomee/apache-tomee/src/main/resources/META-INF/release_notes/RELEASE-NOTES-EAP-7.0.x b/tomee/apache-tomee/src/main/resources/META-INF/release_notes/RELEASE-NOTES-EAP-7.0.x
@@ -5,6 +5,7 @@
 * Update to Tomcat 8.5.100 to Mitigate CVE-2024-23672 and CVE-2024-24549
 * Update jose4j 0.9.6 to mitigate CVE-2023-51775
 * Update to CXF 3.1.19-TT.9 to mitigate CVE-2024-28752
+* Upgrade to Bouncy Castle 1.78 to mitigate CVE-2024-29857, CVE-2024-30171, CVE-2024-30172, CVE-2024-301XX.
 
 === Changes in TomEE EAP 7.1.5-TT.24
 * Update to Tomcat 8.5.96 to mitigate CVE-2023-42795

diff --git a/tomee/tomee-embedded/pom.xml b/tomee/tomee-embedded/pom.xml
@@ -475,7 +475,7 @@
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcmail-jdk15to18</artifactId>
-      <version>1.75</version>
+      <version>1.78</version>
       <scope>test</scope>
     </dependency>
   </dependencies>