mirror of https://github.com/zhigang1992/react-native.git synced 2026-05-17 19:33:12 +08:00

Files

Quentin Valmori 8b59ef6818 Upgrade BouncyCastle [CVE] (#19074 )

Summary:
This PR fixes no existing issue. BouncyCastle library is used inside React-Native but the current version is not updated anymore and this version is subject to `CVE-2013-0169`

Current maven link : http://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk16/1.46 . The descrption says that this jar is for SDK 1.6 but no updated since 2011.

Proposed maven link : http://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk15on The description says that that jar is for SDK 1.5 to SDK 1.8 and latest release was done in January 2018.

Nop.

But there was a discussion about bouncy castle few years ago https://github.com/facebook/react-native/issues/2793

[GENERAL] [Changes] robolectric - Upgrade bouncycastle lib to fix CSV vulnerabilities

Pull Request resolved: https://github.com/facebook/react-native/pull/19074

Reviewed By: mmmulani

Differential Revision: D14068062

Pulled By: hramos

fbshipit-source-id: 24e63cab33c3e8b5a088b9a8843afdc23b43553d

2019-02-14 14:53:20 -08:00