Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.

This update for bouncycastle fixes the following issues :

Version update to 1.60 :

  - CVE-2018-1000613: Use of Externally-ControlledInput to     Select Classes or Code (boo#1100694)

  - Release notes:
    http://www.bouncycastle.org/releasenotes.html

Version update to 1.59 :

  - CVE-2017-13098: Fix against Bleichenbacher oracle when     not using the lightweight APIs (boo#1072697).

  - Release notes:
    http://www.bouncycastle.org/releasenotes.html

This update for bouncycastle fixes the following issues :

Security issues fixed :

  - CVE-2018-1000613: Fix use of Externally-Controlled Input     to Select Classes or Code ('Unsafe Reflection')     (boo#1100694).

  - CVE-2017-13098: Fix against Bleichenbacher oracle when     not using the lightweight APIs (boo#1072697).

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities:

  - XML external entity (XXE) vulnerability in the SqlXmlUtil code     in Apache Derby before 10.12.1.1, when a Java Security Manager     is not in place, allows context-dependent attackers to read     arbitrary files or cause a denial of service (resource     consumption) via vectors involving XmlVTI and the XML datatype.
    (CVE-2015-1832)

  - Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and     earlier have a flaw in the Low-level interface to RSA key pair     generator, specifically RSA Key Pairs generated in low-level API     with added certainty may have less M-R tests than expected. This     appears to be fixed in versions BC 1.60 beta 4 and later,     BC-FJA 1.0.2 and later. (CVE-2018-1000180)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: WLS Core Components). Supported     versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3.
    Easily exploitable vulnerability allows high privileged attacker     with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to     critical data or all Oracle WebLogic Server accessible data as     well as unauthorized read access to a subset of Oracle WebLogic     Server accessible data and unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Oracle WebLogic     Server. (CVE-2019-2452)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: WLS Core Components). Supported     versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3.
    Difficult to exploit vulnerability allows unauthenticated     attacker with network access via T3 to compromise Oracle     WebLogic Server. While the vulnerability is in Oracle WebLogic     Server, attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle     WebLogic Server accessible data as well as unauthorized read     access to a subset of Oracle WebLogic Server accessible data and     unauthorized ability to cause a partial denial of service     (partial DOS) of Oracle WebLogic Server. (CVE-2019-2418)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: WLS - Web Services). The     supported version that is affected is 10.3.6.0. Easily     exploitable vulnerability allows low privileged attacker with     network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Oracle WebLogic Server     accessible data and unauthorized ability to cause a partial     denial of service (partial DOS) of Oracle WebLogic Server.
    (CVE-2019-2395)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: Application Container - JavaEE).     The supported version that is affected is 12.2.1.3. Easily     exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Oracle WebLogic Server     accessible data. (CVE-2019-2441)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: WLS - Deployment). Supported     versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3.
    Easily exploitable vulnerability allows low privileged attacker     with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle     WebLogic Server accessible data. (CVE-2019-2398)

  - Legion of the Bouncy Castle Java Cryptography APIs versions prior     to 1.60 are affected by CWE-470: Use of Externally-Controlled     Input to Select Classes or Code ('Unsafe Reflection') flaw in     XMSS/XMSS^MT private key deserialization routines. This allows     an attacker to force execution of arbitrary code. Successful     attack could be conducted via usage of a handcrafted private key     object with references to unexpected classes which allow     malicious commands execution. (CVE-2018-1000613)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: WLS - Web Services). Supported     versions that are affected are 12.1.3.0 and 12.2.1.3. Easily     exploitable vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all     Oracle WebLogic Server accessible data. (CVE-2018-3246)

  - In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted     network packet can be used to request the Derby Network Server     to boot a database whose location and contents are under the     user's control. If the Derby Network Server is not running with     a Java Security Manager policy file, the attack is successful.
    If the server is using a policy file, the policy file must     permit the database location to be read for the attack to work.
    The default Derby Network Server policy file distributed with     the affected releases includes a permissive policy as the     default Network Server policy, which allows the attack to work.
    (CVE-2018-1313)

Security fix for CVE-2018-1000613

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bouncycastle fixes the following issues :

Security issue fixed :

  - CVE-2018-1000613: Fix use of Externally-Controlled Input     to Select Classes or Code ('Unsafe Reflection')     (boo#1100694).

The Legion of the Bouncy Castle reports :

Release 1.60 is now available for download.

CVE-2018-1000180: issue around primality tests for RSA key pair generation if done using only the low-level API.

CVE-2018-1000613: lack of class checking in deserialization of XMSS/XMSS^MT private keys with BDS state information.

ID	Name	Product	Family	Severity
136317	openSUSE Security Update : bouncycastle (openSUSE-2020-607)	Nessus	SuSE Local Security Checks	critical
123233	openSUSE Security Update : bouncycastle (openSUSE-2019-546)	Nessus	SuSE Local Security Checks	critical
121226	Oracle WebLogic Server Multiple Vulnerabilities (January 2019 CPU)	Nessus	Misc.	critical
120867	Fedora 28 : bouncycastle (2018-e6894349c9)	Nessus	Fedora Local Security Checks	critical
111544	openSUSE Security Update : bouncycastle (openSUSE-2018-794)	Nessus	SuSE Local Security Checks	critical
111428	openSUSE Security Update : bouncycastle (openSUSE-2018-776)	Nessus	SuSE Local Security Checks	critical
111092	FreeBSD : Several Security Defects in the Bouncy Castle Crypto APIs (fe93803c-883f-11e8-9f0c-001b216d295b)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2018-1000613

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical