Address CVEs with bouncycastle

clojars · Apr 13, 2024 · 3286744 · 3286744
1 parent 50c6cc2
commit 3286744
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/deps.edn b/deps.edn
@@ -53,6 +53,10 @@
   org.apache.lucene/lucene-queryparser {:mvn/version "8.11.1"}
   org.apache.maven/maven-model {:mvn/version "3.8.4"}
   org.apache.maven/maven-repository-metadata {:mvn/version "3.8.4"}
+  ;; Override bouncycastle brought in by buddy-core to address CVE-2024-29857,
+  ;; CVE-2024-30171, CVE-2024-30172
+  org.bouncycastle/bcpkix-jdk18on {:mvn/version "1.78"}
+  org.bouncycastle/bcprov-jdk18on {:mvn/version "1.78"}
   org.clojure/clojure {:mvn/version "1.11.2"}
   org.clojure/tools.logging {:mvn/version "1.2.4"}
   org.clojure/tools.nrepl {:mvn/version "0.2.11"}