Repository navigation
BC-FIPS 1.0.2.3 Vulnerability and compatible with JAVA 17 #1445
|
Hi, The current application uses "bc-fips" version 1.0.2.3 and we are planning to upgrade to Java 17 but as all of us know that "bc-fips" version 1.0.2.3 has the GHSA-68m8-v89j-7j2p bug logged which is a problem. I also understand there is one patch ready but not released yet. Can you please provide your input on this and also can we uptake that patch which is ready for early release to proceed? or do you have a tentative date for the release of the Jar with the CVE fix? Thanks. |
Replies: 3 comments
|
@dghgit - can you please assist or route this to the correct stakeholders? Thank you in advance. |
|
1.0.2.4 is available under the support early access program, it's possible to use it now but we would need to provide some additional paperwork for you to use. We expect it will be another 4 or 5 months before it's certified and possible to provide it for general access. |
|
1.0.2.4 is now available on Maven Central and the BC FIPS pages. |
1.0.2.4 is now available on Maven Central and the BC FIPS pages.