Unsafe Reflection Vulnerability in Legion of the Bouncy Castle Java Cryptography APIs
Summary
CVE-2018-1000613: Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vuln... Affects bouncycastle across 3 version ranges.
< 1.60-1
< 4092ede58da51af9a21e4825fbad0d9a3ef5a223
< cd98322b171b15b3f88c5ec871175147893c31e6
Fixed in 1.60-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Legion of the Bouncy Castle is a Java library that provides cryptographic APIs. It is widely used for encryption, decryption, and other cryptographic operations. The library includes support for various cryptographic algorithms and protocols. However, versions 1.58 up to but not including 1.60 of the library contain a vulnerability that allows for unsafe reflection, which can lead to the execution of unexpected code.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000613, exists in the deserialization of XMSS/XMSS^MT private keys. An attacker can craft a malicious private key that includes references to unexpected classes. When the private key is deserialized, the library may load and execute the unexpected code, leading to potential security breaches. This vulnerability has a CVSS score of 9.8, indicating its high severity.
How To Fix
Minimum fixed version
1.60-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bouncycastleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the library to the fixed version as soon as possible.
Conclusion
The Legion of the Bouncy Castle Java Cryptography APIs versions 1.58 up to but not including 1.60 are vulnerable to an unsafe reflection issue in the deserialization of XMSS/XMSS^MT private keys. This vulnerability can be exploited by an attacker to execute unexpected code, potentially leading to security breaches. To mitigate this vulnerability, it is crucial to update the library to version 1.60 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bouncycastle →
FAQ
The vulnerability allows an attacker to execute unexpected code, potentially leading to security breaches and unauthorized access to sensitive information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time alerts for open-source vulnerabilities.
No, only versions 1.58 up to but not including 1.60 of the library are affected. It is recommended to update to version 1.60 or later to mitigate the vulnerability.
Yes, the vulnerability has been fixed in version 1.60 and later of the Legion of the Bouncy Castle library. It is crucial to update to the fixed version to ensure the security of your application.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for bouncycastle.
