High security alert found in jscep lib

[Vasanthh143]

We analyzed the android apk with Mobsf security tool and find the below.

CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
OWASP Top 10: M5: Insufficient Cryptography
OWASP MASVS: MSTG-CRYPTO-4

Code:org/jscep/message/PkcsPkiEnvelopeDecoder.java

CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
OWASP Top 10: M5: Insufficient Cryptography
OWASP MASVS: MSTG-CRYPTO-4

Code: org/jscep/message/PkcsPkiEnvelopeDecoder.java

Kindly let me know if you need any other details.

Best Regards,
Vasanth.

[aloopkin]

The alert probably refers to the use of DES/3DES, that is kept for backward-compatibility purposes: JSCEP supports perfectly well AES. But since SCEP clients might be outdated, support for DES/3DES is needed in order to keep interoperability.

[petarov]

A little bit different, but vulnerability scanners report jscep as vulnerable with high severity due to Bouncy Castle and commons-io. This can be seen on Maven as well. Any chance for a dependencies-bump release?

[seize-the-dave]

All dependencies have now been updated to latest.