CVE-2018-1000613

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography
APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of
Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)
vulnerability in XMSS/XMSS^MT private key deserialization that can result
in Deserializing an XMSS/XMSS^MT private key can result in the execution of
unexpected code. This attack appear to be exploitable via A handcrafted
private key can include references to unexpected classes which will be
picked up from the class path for the executing application. This
vulnerability appears to have been fixed in 1.60 and later.

Notes