CVE-2018-1000613 — Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserializat

01What is this vulnerability?

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack…

02Affected products

Vendor	Product	Versions
n	a / n/a	n/a

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2018-07-09T20:00:00.000Z
• Last modified: 2024-11-14T20:37:00.531Z

09References

• lists.opensuse.org — http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html
• www.oracle.com — https://www.oracle.com/security-alerts/cpuapr2020.html
• www.oracle.com — https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• www.oracle.com — https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• www.oracle.com — https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• lists.apache.org — https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741…
• www.oracle.com — https://www.oracle.com/security-alerts/cpuoct2020.html
• security.netapp.com — https://security.netapp.com/advisory/ntap-20190204-0003/
• github.com — https://github.com/bcgit/bc-java/commit/4092ede58da51af9a21e4825fbad0d9a3ef5a223…
• github.com — https://github.com/bcgit/bc-java/commit/cd98322b171b15b3f88c5ec871175147893c31e6…
• www.oracle.com — https://www.oracle.com/security-alerts/cpuApr2021.html