SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2018-1000613

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private…

CRITICAL 9.8EPSS 4.77%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.77%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
4.77% probability · 91th percentile
CISA KEV
Not listed
Weakness
CWE-470
Affected
bouncycastle/bc-java · netapp/oncommand workflow automation · opensuse/leap · oracle/api gateway · oracle/banking platform · oracle/business process management suite · oracle/business transaction management · oracle/communications application session controller · oracle/communications converged application server · oracle/communications convergence · oracle/communications diameter signaling router · oracle/communications webrtc session controller · oracle/data integrator · oracle/enterprise manager base platform · oracle/enterprise manager for fusion middleware · oracle/enterprise repository · oracle/managed file transfer · oracle/peoplesoft enterprise peopletools · oracle/retail convenience and fuel pos software · oracle/retail xstore point of service · +4 more
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.