# Hardcoded bouncycastle versions in plugin-cli

**URL:** <https://discuss.elastic.co/t/hardcoded-bouncycastle-versions-in-plugin-cli/248641>\
**Category:** Elasticsearch\
**Created:** [September 15, 2020, 9:24am UTC](https://discuss.elastic.co/t/hardcoded-bouncycastle-versions-in-plugin-cli/248641 "2020-09-15T09:24:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![josephine-rueckert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josephine-rueckert/32/65043_2.png) [@josephine-rueckert](https://discuss.elastic.co/u/josephine-rueckert)\
**Post date:** [September 15, 2020, 9:24am UTC](https://discuss.elastic.co/t/hardcoded-bouncycastle-versions-in-plugin-cli/248641/1 "2020-09-15T09:24:04Z")

</div>

Hi elastic team!

In [https://github.com/elastic/elasticsearch/issues/55145](https://github.com/elastic/elasticsearch/issues/55145) @ikakavas mentioned you're using bouncycastle version 1.64. This matches what I've found in [https://github.com/elastic/elasticsearch/blob/v7.7.0/buildSrc/version.properties#L30](https://github.com/elastic/elasticsearch/blob/v7.7.0/buildSrc/version.properties#L30).

Also [https://github.com/elastic/elasticsearch/blob/333a5d8cdf2783664d1d5a80d0b2534d6bbe635d/plugins/ingest-attachment/build.gradle#L55-L57](https://github.com/elastic/elasticsearch/blob/333a5d8cdf2783664d1d5a80d0b2534d6bbe635d/plugins/ingest-attachment/build.gradle#L55-L57) confirms this by using the version from the version properties file.

However, for instance in [https://github.com/elastic/elasticsearch/blob/v7.7.0/distribution/tools/plugin-cli/build.gradle#L29-L30](https://github.com/elastic/elasticsearch/blob/v7.7.0/distribution/tools/plugin-cli/build.gradle#L29-L30) instead of using the version from the version properties file, it's hardcoded to 1.0.3 and 1.0.1 respectively. This matches versions identified for bouncycastle-fips by our security scans.

Is that a bug or intentional? If it is intentional, why does it differ from the otherwise used version 1.64 as specified in the version properties file?

Looking forward to hear from you about this. Thanks in advance!

Best regards,  
Josephine

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 13, 2020, 9:24am UTC](https://discuss.elastic.co/t/hardcoded-bouncycastle-versions-in-plugin-cli/248641/2 "2020-10-13T09:24:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.