[fix][sec] Upgrade Bouncycastle to 1.75 to address CVE-2023-33201

[lhotari]

Motivation

OWASP Dependency Check fails

Error:  bcprov-ext-jdk15on-1.69.jar: CVE-2023-33201(6.5)
Error:  bcprov-jdk15on-1.69.jar: CVE-2023-33201(6.5)

Upgrade Bouncycastle to 1.75 to address CVE-2023-33201.

Modifications

Bouncycastle has switched to Java 8 (1.8) as the baseline since 1.71. When upgrading to 1.75, it is necessary to
exclude thebc*-jdk15on dependencies and instead use the bc*-jdk18on dependencies. Since many libraries
have the jdk15on dependency as a transient dependency, it is necessary to handle the exclusions while upgrading.

Documentation

• doc
• doc-required
• doc-not-needed
• doc-complete

[lhotari]

  Caused by: java.lang.IllegalArgumentException: cannot handle supplied parameter spec: must be passed IES parameters
  	at org.bouncycastle.jcajce.provider.asymmetric.ec.IESCipher.engineInit(Unknown Source)
  	at java.base/javax.crypto.Cipher.init(Cipher.java:1296)
  	at java.base/javax.crypto.Cipher.init(Cipher.java:1236)
  	at org.apache.pulsar.client.impl.crypto.MessageCryptoBc.addPublicKeyCipher(MessageCryptoBc.java:336)
  	at org.apache.pulsar.client.impl.crypto.MessageCryptoBc.encrypt(MessageCryptoBc.java:395)
  	at org.apache.pulsar.client.impl.ProducerImpl.encryptMessage(ProducerImpl.java:829)
  	at org.apache.pulsar.client.impl.ProducerImpl.serializeAndSendMessage(ProducerImpl.java:682)
  	at org.apache.pulsar.client.impl.ProducerImpl.sendAsync(ProducerImpl.java:559)
  	... 17 more

It seems that some code changes are required:

For at least some ECIES variants (e.g. when using CBC) there is an issue with potential malleability of a nonce (implying silent malleability of the plaintext) that must be sent alongside the ciphertext but is outside the IES integrity check. For this reason the automatic generation of nonces with IED is now disabled and they have to be passed in using an IESParameterSpec. The current advice is to agree on a nonce between parties and then rely on the use of the ephemeral key component to allow the nonce (rather the so called nonce) usage to be extended.

https://www.bouncycastle.org/releasenotes.html , changes in 1.72

[eolivelli]

+1

I wonder if the bookie would start with TLS enabled given that we had to do some changes in the code

[lhotari]

this seems to be the change that makes it necessary to pass the IESParametersSpec:
bcgit/bc-java@5f7b6e7