-
Notifications
You must be signed in to change notification settings - Fork 11
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: Security fix for bouncycastle #83
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why bumping the minor version of the Helm Chart, instead of bumping the patch version to 10? To fix a security issue the application version should be bumped as well.
In addition it would be nice if you could provide clear instructions about expected build workflow runs and GH releases. Otherwise committers will have to wild guess next steps.
…-sd-factory into CVE-2023-33202-fix version no. upgrade for security issue
Hi @carslen i thought next incremental version in a single digit after 2.1.9 will be 2.2.0 |
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.