- Update to version 1.78: [bsc#1223252, CVE-2024-30171] * Security Advisories. - CVE-2024-29857: Importing an EC certificate with specially crafted F2m parameters can cause high CPU usage during parameter evaluation. - CVE-2024-30171: Possible timing based leakage in RSA based handshakes due to exception processing eliminated. - CVE-2024-30172: Crafted signature and public key can be used to trigger an infinite loop in the Ed25519 verification code. - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE and an SSL socket is not created with an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address. This has been fixed. * Defects Fixed: - Issues with a dangling weak reference causing intermittent NullPointerExceptions in the OcspCache have been fixed. - Issues with non-constant time RSA operations in TLS handshakes. - Issue with Ed25519, Ed448 signature verification causing intermittent infinite loop have been fixed. - Issues with non-constant time ML-KEM implementation ("Kyber Slash"). - Align ML-KEM input validation with FIPS 203 IPD requirements. - Make PEM parsing more forgiving of whitespace to align with RFC 7468. - Fix CCM length checks with large nonce sizes (n=12, n=13). - EAC: Fixed the CertificateBody ASN.1 type to support an optional Certification Authority Reference in a Certificate Request. - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized and the contents octets for both types are now limited to 4096 bytes. - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(), which could cause issues for HSM RSA keys. - BCJSSE: When endpoint identification is enabled and an SSL socket is not created with an explicit hostname (as happens with HttpsURLConnection), OBS-URL: https://build.opensuse.org/request/show/1170680 OBS-URL: https://build.opensuse.org/package/show/Java:packages/bouncycastle?expand=0&rev=103
46 lines
1.5 KiB
XML
46 lines
1.5 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<project>
|
|
<modelVersion>4.0.0</modelVersion>
|
|
<groupId>org.bouncycastle</groupId>
|
|
<artifactId>bcpg-jdk18on</artifactId>
|
|
<packaging>jar</packaging>
|
|
<name>Bouncy Castle OpenPGP API</name>
|
|
<version>1.78</version>
|
|
<description>The Bouncy Castle Java API for handling the OpenPGP protocol. This jar contains the OpenPGP API for JDK 1.8 and up. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.</description>
|
|
<url>https://www.bouncycastle.org/java.html</url>
|
|
<licenses>
|
|
<license>
|
|
<name>Bouncy Castle Licence</name>
|
|
<url>https://www.bouncycastle.org/licence.html</url>
|
|
<distribution>repo</distribution>
|
|
</license>
|
|
<license>
|
|
<name>Apache Software License, Version 2.0</name>
|
|
<url>https://www.apache.org/licenses/LICENSE-2.0</url>
|
|
<distribution>repo</distribution>
|
|
</license>
|
|
</licenses>
|
|
<scm>
|
|
<url>https://github.com/bcgit/bc-java</url>
|
|
</scm>
|
|
<issueManagement>
|
|
<system>GitHub</system>
|
|
<url>https://github.com/bcgit/bc-java/issues</url>
|
|
</issueManagement>
|
|
<developers>
|
|
<developer>
|
|
<id>feedback-crypto</id>
|
|
<name>The Legion of the Bouncy Castle Inc.</name>
|
|
<email>feedback-crypto@bouncycastle.org</email>
|
|
</developer>
|
|
</developers>
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.bouncycastle</groupId>
|
|
<artifactId>bcprov-jdk18on</artifactId>
|
|
<version>1.78</version>
|
|
<type>jar</type>
|
|
</dependency>
|
|
</dependencies>
|
|
</project>
|