Critical Security Severity on 4.9.4

[Boldbayar]

Hello, I have found the following security issue by scanning with snyk

Provides transitive vulnerable dependency org.bouncycastle:bcprov-jdk15on:1.68

1. https://advisory.checkmarx.net/advisory/vulnerability/Cxa9261daf-3755/ on dependency

[jjanczur]

I see it as well. You can probably fix it by forcing maven/Gradle to use a higher version of the bouncy castle in properties (similarly to upgrading log4j lib - CVE-2021-45105 ) but I don't know if it won't break the library/tests.

[mohamedelshami]

@Boldbayar thank you for this finding, we will look into possibly adding a dependency override.