A flaw was found in Legion of the Bouncy Castle Java Cryptography APIs version prior to 1.60. A lack of class checking in the deserialization of XMSS/XMSS^MT private keys with BDS state information can result in the execution of unexpected code.
Created bouncycastle tracking bugs for this issue:
Affects: epel-all [bug 1601099]
Affects: fedora-all [bug 1601098]
The XMSS/XMSS^MT algorithms were first introduced in upstream bouncycastle version 1.57. Versions prior to this, that have not had the new algorithms back-ported, are not affected.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):