From ff97642301cdef14252b5ed30b65a0b12c5a54e3 Mon Sep 17 00:00:00 2001
From: Paul Watson <paul_watson@rapid7.com>
Date: Wed, 6 Nov 2024 16:52:47 +0000
Subject: [PATCH] Overriding the vulnerable version of bouncy castle

---
 pom.xml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 1e2800d..3bff6d3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -44,7 +44,8 @@
    </distributionManagement>
 
    <properties>
-      <thirdparty.commons-io.version>2.7</thirdparty.commons-io.version>
+      <thirdparty.bouncycastle.version>1.78.1</thirdparty.bouncycastle.version>
+      <thirdparty.commons-io.version>2.14.0</thirdparty.commons-io.version>
       <thirdparty.commons-lang3.version>3.4</thirdparty.commons-lang3.version>
       <thirdparty.guava.version>33.0.0-jre</thirdparty.guava.version>
       <thirdparty.hamcrest.version>1.3</thirdparty.hamcrest.version>
@@ -59,6 +60,13 @@
    </properties>
 
    <dependencies>
+     <!-- the version of bouncycastle in smbj is vulnerable     -->
+     <dependency>
+       <groupId>org.bouncycastle</groupId>
+       <artifactId>bcprov-jdk18on</artifactId>
+       <version>${thirdparty.bouncycastle.version}</version>
+       <scope>runtime</scope>
+     </dependency>
       <!-- 3rdparty dependencies. -->
       <dependency>
          <groupId>commons-io</groupId>