Several vulnerabilities in the shared library which oss-allegro depends on.

[HelenParr]

Hi, @bruceskingle , I'd like to report a vulnerability issue in com.symphony.oss.allegro:allegro2-api:0.6.0.

Issue Description

com.symphony.oss.allegro:allegro2-api:0.6.0 directly depends on 1 C library(.so). However, I noticed that the C library is vulnerable, containing the following CVEs:

libsymphonycryptolibjni.so from C project openssl(version:1.0.2t) exposed 3 vulnerabilities:
CVE-2021-3712, CVE-2021-23839, CVE-2020-1968

Suggested Vulnerability Patch Versions

openssl has fixed the vulnerabilities in versions >=1.1.1l

Java build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Java projects.
Could you please upgrade the above shared libraries to their patch versions?

Thanks for your help~
Best regards,
Helen Parr