.NET update BouncyCastle.Cryptography dependency version to at least 2.3.1

[vadym-ustymenko]

Nuget package AWS.Cryptography.EncryptionSDK 4.1.0 has a dependency on BouncyCastle.Cryptography (>= 2.2.1) which has few vulnerabilities with moderate severity:
GHSA-8xfc-gm6g-vgpv
GHSA-v435-xc8x-wvr9
GHSA-m44j-cfrm-g8qc

BouncyCastle.Cryptography 2.3.1 has those vulnerabilities fixed

[rishav-karanjit]

Hi @vadym-ustymenko, we are tracking this and updating the bouncy castle version is in our roadmap for the next release. In the meantime, you can resolve this by overriding the AWS.Cryptography.MaterialProviders dependency to use version 1.4.0 or later. This will automatically use BouncyCastle.Cryptography 2.3.1 as a transitive dependency.

To implement this override, add the AWS.Cryptography.MaterialProviders package manually to your project using the following command:

dotnet add package AWS.Cryptography.MaterialProviders --version 1.4.0

Note that 1.4.0 is an example version. Any version 1.4.0 or later should work for this purpose.