Please update Bouncy Castle

[Neustradamus]

Please update Bouncy Castle

• https://www.bouncycastle.org/
• https://www.bouncycastle.org/releasenotes.html
• http://www.bouncycastle.org/latest_releases.html
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncy%20castle
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncycastle
• https://www.cvedetails.com/vulnerability-list/vendor_id-7637/Bouncycastle.html

[lavaleri]

Thanks for reaching out! The AWS DynamoDB Client-side Encryption in Java only uses Bouncy Castle in it's testing, and thus is not impacted by CVE-2019-17359.

Regardless, I've cut a PR to upgrade Bouncy Castle as part of our next release.

[lavaleri]

The PR has been merged and Bouncy Castle is scheduled to be upgraded as part of our next release. Thanks again!

[Neustradamus]

@lavaleri: Thanks!

It is better to always update libraries (not only here) ;)

[Neustradamus]

@lavaleri: Can you update to 1.69?

[alex-chew]

This is resolved in #159 and released in v2.0.3.

[Neustradamus]

@alex-chew: Thanks!