[Snyk] Fix for 6 vulnerabilities

[chrislin22]

Snyk has created this PR to fix 6 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Improper Certificate Validation SNYK-JAVA-ORGBOUNCYCASTLE-18519206	751	org.bouncycastle:bc-fips: 1.0.2 -> 2.0.2 org.bouncycastle:bcpkix-fips: 1.0.2 -> 2.0.7 Major version upgrade No Known Exploit
	Inefficient Algorithmic Complexity SNYK-JAVA-ORGBOUNCYCASTLE-18518056	721	org.bouncycastle:bc-fips: 1.0.2 -> 2.0.2 No Known Exploit
	Memory Allocation with Excessive Size Value SNYK-JAVA-ORGBOUNCYCASTLE-18518102	721	org.bouncycastle:bc-fips: 1.0.2 -> 2.0.2 No Known Exploit
	Uncontrolled Recursion SNYK-JAVA-ORGBOUNCYCASTLE-18519025	721	org.bouncycastle:bc-fips: 1.0.2 -> 2.0.2 No Known Exploit
	Improper Validation of Integrity Check Value SNYK-JAVA-ORGBOUNCYCASTLE-18519142	721	org.bouncycastle:bc-fips: 1.0.2 -> 2.0.2 No Known Exploit
	Improper Validation of Integrity Check Value SNYK-JAVA-ORGBOUNCYCASTLE-18519225	721	org.bouncycastle:bcpkix-fips: 1.0.2 -> 2.0.7 No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled Recursion

[chrislin22]

The upgrade from Bouncy Castle FIPS 1.x to 2.x is a major version change with significant breaking changes related to dependencies, APIs, and algorithm support to align with current FIPS standards.

Key Breaking Changes:

• New Dependency Required: A new bcutil-fips.jar has been introduced which contains classes moved out of the main FIPS provider JAR. This dependency must be added to your application's classpath.
• Disabled Algorithms in FIPS Mode: To comply with FIPS transitions, several algorithms are now blocked when the provider is in approved mode.
  • RSA PKCS#1.5 encryption is blocked. Applications must migrate to a padding scheme like OAEP.
  • SHA-1 for signature generation is blocked.
  • Triple DES (DES-EDE) encryption is blocked. Applications must migrate to AES.
• Low-Level API Changes: The getIV() method has been removed from FipsAES.Parameters. Code using these low-level APIs must be updated, though applications using the standard JCA/JCE layer are less likely to be affected.
• Oracle JSSE Support Removed: Support for internal KDFs used by Oracle's JSSE provider has been removed. The official recommendation is to use the Bouncy Castle JSSE provider (bctls.jar) instead.

Source: Bouncy Castle FIPS Migration Hints – BC-FJA 1.0.2.* to 2.0.0.

Recommendation: This upgrade requires careful validation. Developers must add the new bcutil-fips.jar dependency and thoroughly audit their application to ensure no reliance on the newly disabled cryptographic algorithms (RSA PKCS#1.5, SHA-1 signatures, 3DES) in FIPS mode. If the application integrates with Oracle's JSSE, it will need to be migrated to use the Bouncy Castle JSSE provider.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.