PT-2018-2791 · Legion Of The Bouncy Castle+1 · Legion Of The Bouncy Castle Java Cryptography Apis+1
Published
2018-07-09
·
Updated
2024-06-15
·
CVE-2018-1000613
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Legion of the Bouncy Castle Java Cryptography APIs versions 1.57 through 1.59
Description
The issue is related to the deserialization of XMSS/XMSS^MT private keys, which can result in the execution of unexpected code. This is due to the use of externally-controlled input to select classes or code, also known as 'Unsafe Reflection'. An attacker can exploit this by creating a handcrafted private key that includes references to unexpected classes, which will be picked up from the class path for the executing application.
Recommendations
For versions 1.57 through 1.59, update to version 1.60 or later to resolve the issue.
As a temporary workaround, consider restricting the use of XMSS/XMSS^MT private key deserialization until a patch is available.
Avoid using handcrafted private keys that include references to unexpected classes in the affected API endpoints until the issue is resolved.
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Legion Of The Bouncy Castle Java Cryptography Apis
Suse