[HIVE-28065] Upgrade Bouncy castle to bcprov-jdk18on 1.77 - ASF JIRA

Log work

Agile Board

Rank to Top

Rank to Bottom

Bulk Copy Attachments

Bulk Move Attachments

Voters

Watch issue

Watchers

Create sub-task

Convert to sub-task

Move

Link

Clone

Labels

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Bug
Status: Closed
Priority: Major
Resolution: Fixed
Affects Version/s: None
Fix Version/s: 4.0.0
Component/s: None
Labels:
- pull-request-available

Description

For Bouncy Castle for java before 1.74(excluding), it was discovered that there was a potential LDAP injection. During the certificate validation process, bouncycastle used the certificate's "Subject Name" into an LDAP search filter without any escaping.

https://nvd.nist.gov/vuln/detail/CVE-2023-33201