Re: [SignServer-develop] Update iText

[Markus K. <mar...@pr...>]

On 3/25/20 3:09 PM, Arnaud Defos wrote:
> Hi everyone,
> 
> The version of iText is very very old !
> 
> Is there an update scheduled ? It could resolve a lot of bugs and it is
> necessary to reduce security issues.
> 
> Thanks !
> 
> Arnaud

Hi Arnaud,

SignServer has a fork of the last officially released version of iText
(2.1.7) before it switch license model. We can not use the latest
versions as they are AGPL licensed and thus not compatible with LGPL.

Is there any particular bugs or security issues that you have in mind?
Also note that SignServer only uses a small part of the library needed
to calculate and insert the signatures.

Cheers,
Markus