Candidate: CVE-2018-1000613
PublicDate: 2018-07-09 20:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000613
Description:
 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography
 APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of
 Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
 vulnerability in XMSS/XMSS^MT private key deserialization that can result
 in Deserializing an XMSS/XMSS^MT private key can result in the execution of
 unexpected code. This attack appear to be exploitable via A handcrafted
 private key can include references to unexpected classes which will be
 picked up from the class path for the executing application. This
 vulnerability appears to have been fixed in 1.60 and later.
Ubuntu-Description:
Notes:
 debian> (XMSS/XMSS^MT algorithms were first introduced in BC >= 1.57)
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]


Patches_bouncycastle:
 other: https://github.com/bcgit/bc-java/commit/4092ede58da51af9a21e4825fbad0d9a3ef5a223#diff-2c06e2edef41db889ee14899e12bd574
 other: https://github.com/bcgit/bc-java/commit/cd98322b171b15b3f88c5ec871175147893c31e6#diff-148a6c098af0199192d6aede960f45dc
upstream_bouncycastle: released (1.60-1)
precise/esm_bouncycastle: DNE
trusty_bouncycastle: not-affected (1.49+dfsg-2)
trusty/esm_bouncycastle: DNE (trusty was not-affected [1.49+dfsg-2])
xenial_bouncycastle: not-affected (1.51-4ubuntu1)
artful_bouncycastle: ignored (reached end-of-life)
bionic_bouncycastle: needed
cosmic_bouncycastle: not-affected (1.60-1)
disco_bouncycastle: not-affected (1.60-1)
eoan_bouncycastle: not-affected (1.60-1)
focal_bouncycastle: not-affected (1.60-1)
groovy_bouncycastle: not-affected (1.60-1)
hirsute_bouncycastle: not-affected (1.60-1)
impish_bouncycastle: not-affected (1.60-1)
jammy_bouncycastle: not-affected (1.60-1)
devel_bouncycastle: not-affected (1.60-1)