CVE-2018-1000613

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in XMSS/XMSS^MT private key deserialization that can result in...

UBUNTU-CVE-2018-1000613

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in XMSS/XMSS^MT private key deserialization that can result in...

CVE-2018-1000613

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in XMSS/XMSS^MT private key deserialization that can result in...

CVE-2018-1000613

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in XMSS/XMSS^MT private key deserialization that can result in...

CVE-2018-1000613

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in XMSS/XMSS^MT private key deserialization that can result in...

CVE-2018-1000613

CVE-2018-1000613 concerns Legion of the Bouncy Castle Java Cryptography APIs (BC) 1.58–1.59 up to, but not including, 1.60. It is a CWE-470 Unsafe Reflection vulnerability in XMSS/XMSS^MT private key deserialization, which can allow a remote attacker to execute arbitrary code by crafting a privat...

CVE-2018-1000613

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in XMSS/XMSS^MT private key deserialization that can result in...

Debian DLA-1418-1 : bouncycastle security update

Several security vulnerabilities were found in Bouncy Castle, a Java implementation of cryptographic algorithms. CVE-2016-1000338 DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have...

CVE-2018-1000613: Use of Externally-Controlled Input to Select Classes or Code

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in XMSS/XMSS^MT private key deserialization that can result in...

PT-2018-2791

Name of the Vulnerable Software and Affected Versions Legion of the Bouncy Castle Java Cryptography APIs versions 1.57 through 1.59 Description The issue is related to the deserialization of XMSS/XMSS^MT private keys, which can result in the execution of unexpected code. This is due to the use of...

Several Security Defects in the Bouncy Castle Crypto APIs

The Legion of the Bouncy Castle reports: Release 1.60 is now available for download. CVE-2018-1000180: issue around primality tests for RSA key pair generation if done using only the low-level API. CVE-2018-1000613: lack of class checking in deserialization of XMSS/XMSS^MT private keys with BDS...

Security Bulletin: Public disclosed vulnerability from Bouncy Castle affects Platform PCM

Summary Public disclosed vulnerability CVE-2018-5382 from Bouncy Castle fix was addressed by Platform PCM Vulnerability Details Data not yet populated. Affected Products and Versions Platform Cluster Manager Standard Edition Version 4.1.0, 4.1.1 and 4.1.1.1 Platform Cluster Manager Version 4.2.0,...

Security Bulletin: Public disclosed vulnerability from Bouncy Castle affects Platform HPC

Summary Public disclosed vulnerability CVE-2018-5382 from Bouncy Castle fix was addressed by Platform HPC Vulnerability Details Data not yet populated Affected Products and Versions Platform HPC Version 4.1.1, 4.1.1.1, 4.2.0 and 4.2.1 Remediation/Fixes None. Workarounds and Mitigations Product |...

[SECURITY] Fedora 28 Update: bouncycastle-1.59-1.fc28

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8...

[SECURITY] Fedora 27 Update: bouncycastle-1.59-1.fc27

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8...

Security Bulletin: A vulnerbility in Bouncy Castle affects Rational Service Tester (CVE-2015-7940 )

Summary Bouncy Castle could allow a remote attacker to obtain sensitive information, caused by an invalid curve attack. An attacker could exploit this vulnerability to extract private keys used in elliptic curve crytpography and obtain sensitive information. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects Rational Service Tester (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects Rational Service Tester. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange messag...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects Rational Performance Tester (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects Rational Performance Tester. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange...

Security Bulletin: Open-source Bouncy Castle vulnerability affects IBM® WebSphere Cast Iron (CVE-2015-7940)

Summary There is a vulnerability in Bouncy Castle version 1.49 that is used by WebSphere Cast Iron. Vulnerability Details CVEID: CVE-2015-7940 DESCRIPTION: Bouncy Castle could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability using an invalid...

Unspecified Vulnerability in Bouncy Castle JCE Provider

Bouncy Castle JCE Provider is a Java-based encryption package. A security vulnerability exists in the DHIES/ECIES CBC mode in Bouncy Castle JCE Provider 1.55 and earlier versions. An attacker can exploit the vulnerability via padding to determine the cause of a decryption failure...