Determine Bouncycastle version in Java modules?

Aspose.PDF Product Family
1

Hi,

In some of the Aspose libraries (e.g aspose-pdf), a version of the Bouncycastle library is included within the jar (i.e. not as a maven dependency).

However, I’m unable to find any information about the exact version that is used. Is there a way to determine this exact version?

Kind regards,

2

@edorasware

Just to confirm again, are you interested in an older version of the API? Can you please share why are you seeking this dependency which was removed due to possible vulnerability in the past?

3

No, I’m looking at the recent version 24.2 of Aspose.

In the aspose-pdf jar, there’s a package com.aspose.pdf.internal.imaging.internal.bouncycastle that includes many Bouncycastle classes (i.e. by copying the java classes, and not by a dependency in Maven). But I cannot find what exact version of Bouncycastle this is (e.g. for security vulnerabiluty scanners), that’s what I’m looking for.

Kind regards,

4

@edorasware

Please allow us to gather the related information and we will get back to you soon.

5

Thanks, appreciated.

6

@edorasware

Usually we use the latest version. We are currently using the public version of bc-fips: 1.0.2.3. We will move to bc-fips-1.0.2.4 soon.

7

Ok thanks for the info. I’ll investigate the implications of that. Many thanks.

8

@edorasware

Sure, please feel free to let us know in case you need further assistance.