Hello,
I can confirm iText 2.1.7.js5 uses bouncycastle:bcprov-jdk14 according to iText 2.1.7.js5.pom included in JasperReport 6.3.0.
----------
<dependencies>
<dependency>
<groupId>bouncycastle</groupId>
<artifactId>bcmail-jdk14</artifactId>
<version>138</version>
</dependency>
<dependency>
<groupId>bouncycastle</groupId>
<artifactId>bcprov-jdk14</artifactId>
<version>138</version>
</dependency>
<dependency>
<groupId>bouncycastle</groupId>
<artifactId>bctsp-jdk14</artifactId>
<version>138</version>
</dependency>
</dependencies>
----------
Does iText 2.1.7.js5 use JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.4 ?
I'm worried whether iText 2.1.7.js5 is relevant to below report or not.
https://snyk.io/vuln/maven:org.bouncycastle:bcprov-jdk14
Best,
