PT-2018-2791 · Legion Of The Bouncy Castle+1 · Legion Of The Bouncy Castle Java Cryptography Apis+1
Publicado
2018-07-09
·
Atualizado
2024-06-15
·
CVE-2018-1000613
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Legion of the Bouncy Castle Java Cryptography APIs versions 1.57 through 1.59
Description
The issue is related to the deserialization of XMSS/XMSS^MT private keys, which can result in the execution of unexpected code. This is due to the use of externally-controlled input to select classes or code, also known as 'Unsafe Reflection'. An attacker can exploit this by creating a handcrafted private key that includes references to unexpected classes, which will be picked up from the class path for the executing application.
Recommendations
For versions 1.57 through 1.59, update to version 1.60 or later to resolve the issue.
As a temporary workaround, consider restricting the use of XMSS/XMSS^MT private key deserialization until a patch is available.
Avoid using handcrafted private keys that include references to unexpected classes in the affected API endpoints until the issue is resolved.
Correção
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Legion Of The Bouncy Castle Java Cryptography Apis
Suse