CVE-2018-1000613: Deserialization of Untrusted Data in Bouncy castle
Summary
CVE-2018-1000613: Deserialization of Untrusted Data in Bouncy castle. Affects org.bouncycastle:bcprov-jdk15on versions >= 1.57, < 1.60. Fixed in 1.60. How to fix ↓
Also tracked for
- bouncycastle · Debian:11
The same CVE-2018-1000613 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bouncy Castle Java Cryptography APIs is a widely used library for cryptographic operations in Java applications. It provides various cryptographic algorithms and protocols. The vulnerability (CVE-2018-1000613) affects versions prior to 1.60 of the library. This vulnerability specifically impacts the XMSS/XMSS^MT private key deserialization functionality. The library allows deserialization of private keys, which can be exploited by an attacker to execute unexpected code. The vulnerability arises from the use of unsafe reflection, where externally-controlled input can select classes or code to be executed.
Vulnerability Detail
The vulnerability allows an attacker to craft a malicious private key that includes references to unexpected classes. When the private key is deserialized, the library will load and execute these unexpected classes from the class path of the application. This can lead to the execution of arbitrary code, potentially compromising the security and integrity of the application. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
1.60
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the library to mitigate the risk.
Conclusion
The vulnerability (CVE-2018-1000613) in the Bouncy Castle library prior to version 1.60 allows for the deserialization of untrusted data, leading to the execution of unexpected code. To mitigate this vulnerability, it is crucial to upgrade to version 1.60 or later of the library. Vulert Playground (https://vulert.com/scanner) can be used to check if your application is affected by this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.bouncycastle:bcprov-jdk15on →
FAQ
The vulnerability allows an attacker to execute arbitrary code, potentially leading to remote code execution, data breaches, or other security compromises.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are detected.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to apply the fix promptly to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely if the application deserializes maliciously crafted private keys.
There is no evidence of active exploitation of this vulnerability at the time of writing. However, it is recommended to apply the fix as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.bouncycastle:bcprov-jdk15on.
