fix: SHA1Digest should not be cloned to Md5Digest

[winfriedgerlach]

Maybe I'm wrong, but it looks like a bug to me if cloning a "SHA-1" digest results in an Md5Digest

[dghgit]

Yes, I don't think that's right at all. I've made the change. Thanks for the report.

[dovezp]

I'm getting a false positive report now with nexus sonarqube @axsonatype @Garrestocles

It clearly was addressed in the 8ecc0b3 1.81 release.

sonatype-2025-001911
 org.bouncycastle : bcprov-jdk18on : 1.81
Issue
sonatype-2025-001911
Severity
Sonatype CVSS 46.9
Weakness
Sonatype CWE[328](https://cwe.mitre.org/data/definitions/328.html)
Source
Sonatype Data Research
Categories
Data
Explanation
Bouncy Castle is vulnerable due to the Use of Weak Hash. The createClone() method in the DigestFactory$2.class class does not properly clone SHA-1 hashes. An unsuspected developer can use the vulnerable method to perform cryptographic operations, exposing the application to collision attacks.

Detection
The application is vulnerable by using this component.

Recommendation
We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Note: If this component is included as a bundled/transitive dependency of another component, there may not be an upgrade path. In this instance, we recommend contacting the maintainers who included the vulnerable package. Alternatively, we recommend investigating alternative components or a potential mitigating control.

Version Affected
[1.71,1.81]

Root Cause
bcprov-jdk18on-1.81.jarorg/bouncycastle/crypto/util/DigestFactory$2.class(,)

Advisories
Projecthttps://github.com/bcgit/bc-java/pull/2041
Projecthttps://www.bouncycastle.org/download/bouncy-castle-java/?filter=java%3Drelease-1-81

Shouldn't it be? or of the likes

Version Affected
[1.71,1.81)

Also, is there a easier way for me to contact your company representatives for these false positives that keep occurring without going to the support desk https://support.sonatype.com/hc/en-us/requests/new

I find it hard to believe that they are rare if they keep happening every month.