CVE-2018-1000613 : Security Advisory and Response

The Java Cryptography APIs version 1.58 to 1.60, excluding 1.60, of Legion of the Bouncy Castle contain a vulnerability categorized as CWE-470. This vulnerability involves the use of externally-controlled input for selecting classes or code, also known as 'Unsafe Reflection'. The specific vulnerability lies in the deserialization of XMSS/XMSS^MT private keys, where the deserialization process may lead to the execution of unanticipated code. This vulnerability can potentially be exploited if a custom-crafted private key includes references to unexpected classes, which will be accessed from the class path of the running application. The issue has been addressed and resolved in versions 1.60 and later.

Understanding CVE-2018-1000613

This section provides an overview of the vulnerability and its impact.

What is CVE-2018-1000613?

CVE-2018-1000613 is a vulnerability in Legion of the Bouncy Castle Java Cryptography APIs version 1.58 up to but not including 1.60. It is classified as CWE-470, involving 'Unsafe Reflection' in the deserialization of XMSS/XMSS^MT private keys.

The Impact of CVE-2018-1000613

The vulnerability can result in the execution of unexpected code by deserializing an XMSS/XMSS^MT private key. It can be exploited through a handcrafted private key containing references to unexpected classes from the application's class path.

Technical Details of CVE-2018-1000613

This section delves into the technical aspects of the vulnerability.

Vulnerability Description

The vulnerability in Legion of the Bouncy Castle Java Cryptography APIs version 1.58 up to but not including 1.60 involves 'Unsafe Reflection' in XMSS/XMSS^MT private key deserialization, allowing the execution of unanticipated code.

Affected Systems and Versions

Product: n/a
Vendor: n/a
Versions affected: 1.58 to 1.60 (excluding 1.60)

Exploitation Mechanism

The vulnerability can be exploited by crafting a private key with references to unexpected classes, which are then accessed from the application's class path.

Mitigation and Prevention

This section outlines steps to mitigate and prevent the CVE-2018-1000613 vulnerability.

Immediate Steps to Take

Update to version 1.60 or later to address the vulnerability.
Implement input validation to prevent the use of externally-controlled input for class selection.

Long-Term Security Practices

Regularly monitor for security advisories and updates from the vendor.
Conduct security assessments and code reviews to identify and address similar vulnerabilities.

Patching and Updates

Apply patches and updates provided by Legion of the Bouncy Castle to ensure the security of the Java Cryptography APIs.