{"id":"CVE-2018-1000613","aliases":["DEBIAN-CVE-2018-1000613","EUVD-2018-0492","GHSA-4446-656p-f54g","MGASA-2018-0376","ROOT-APP-MAVEN-CVE-2018-1000613","UBUNTU-CVE-2018-1000613","openSUSE-SU-2020:0607-1","openSUSE-SU-2024:10661-1"],"status":"published","title":"Deserialization of Untrusted Data in Bouncy castle","description":"Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04767,"percentile":0.91965,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-470","CWE-502"],"published":"2018-07-09T20:00:00Z","modified":"2026-10-23T18:04:46Z","fixes":[{"ecosystem":"Maven","package":"org.bouncycastle:bcprov-jdk15on","fixed_in":["1.60"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"bouncycastle","fixed_in":["1.60-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bouncycastle","fixed_in":["1.60-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bouncycastle","fixed_in":["1.60-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.bouncycastle:bcprov-jdk15on","fixed_in":["1.60-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.bouncycastle:bcprov-jdk15on","fixed_in":["1.60-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.bouncycastle:bcprov-jdk15on","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.57"},{"fixed":"1.60"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bouncycastle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bouncycastle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bouncycastle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.bouncycastle:bcprov-jdk15on","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.57"},{"fixed":"1.60"}]}],"versions":["1.57","1.58","1.59"]},{"source":"osv","ecosystem":"Mageia:6","package":"bouncycastle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Root:Maven","package":"org.bouncycastle:bcprov-jdk15on","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.bouncycastle:bcprov-jdk15on","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bouncycastle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.57-1","1.58-1","1.59-1","1.59-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"bouncycastle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60-lp151.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bouncycastle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.68-3.2"}]}],"bundled":16}],"products":[{"vendor":"bouncycastle","product":"bc-java"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"api_gateway"},{"vendor":"oracle","product":"banking_platform"},{"vendor":"oracle","product":"business_process_management_suite"},{"vendor":"oracle","product":"business_transaction_management"},{"vendor":"oracle","product":"communications_application_session_controller"},{"vendor":"oracle","product":"communications_converged_application_server"},{"vendor":"oracle","product":"communications_convergence"},{"vendor":"oracle","product":"communications_diameter_signaling_router"},{"vendor":"oracle","product":"communications_webrtc_session_controller"},{"vendor":"oracle","product":"data_integrator"},{"vendor":"oracle","product":"enterprise_manager_base_platform"},{"vendor":"oracle","product":"enterprise_manager_for_fusion_middleware"},{"vendor":"oracle","product":"enterprise_repository"},{"vendor":"oracle","product":"managed_file_transfer"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"oracle","product":"retail_convenience_and_fuel_pos_software"},{"vendor":"oracle","product":"retail_xstore_point_of_service"},{"vendor":"oracle","product":"soa_suite"},{"vendor":"oracle","product":"utilities_network_management_system"},{"vendor":"oracle","product":"webcenter_portal"},{"vendor":"oracle","product":"weblogic_server"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190204-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/bcgit/bc-java/commit/4092ede58da51af9a21e4825fbad0d9a3ef5a223#diff-2c06e2edef41db889ee14899e12bd574","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"https://github.com/bcgit/bc-java/commit/cd98322b171b15b3f88c5ec871175147893c31e6#diff-148a6c098af0199192d6aede960f45dc","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000613","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4446-656p-f54g","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","tags":["web"]},{"url":"https://github.com/bcgit/bc-java/commit/cc9f91c41be67e88fca4e38f4872418448950fd9","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190204-0003","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1000613","tags":["advisory"]},{"url":"https://github.com/bcgit/bc-java","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2018-0376.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22197","tags":["report"]},{"url":"https://www.debian.org/security/2018/dsa-4233","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-06/msg00085.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-07/msg00089.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-1000613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000613","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SJ5CQDJZHIR5UUASDLGQDV3YILWDOSU3/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1072697","tags":["report"]},{"url":"https://bugzilla.suse.com/1100694","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000613","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28052","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1000613","description":"Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.","status":"published","published":"2018-07-09T20:00:00Z","modified":"2024-11-14T20:37:00.531Z","updated_at":"2026-11-02T14:35:10.313768Z"}],"euvd":[{"id":"EUVD-2018-0492","description":"Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.","status":"published","published":"2018-07-09T20:00:00Z","modified":"2024-11-14T20:37:00Z","updated_at":"2026-11-03T00:04:59.953537Z"}],"ghsa":[{"id":"GHSA-4446-656p-f54g","title":"Deserialization of Untrusted Data in Bouncy castle","description":"Legion of the Bouncy Castle Java Cryptography APIs starting in version 1.57 and prior to version 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. \n\nThis vulnerability appears to have been fixed in 1.60 and later.","status":"published","published":"2018-10-17T16:23:12Z","modified":"2025-05-12T21:40:34Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-470","CWE-502"],"updated_at":"2026-11-02T14:38:43.172412Z"}],"nvd":[{"id":"CVE-2018-1000613","description":"Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.","status":"published","published":"2018-07-09T20:29:00.283Z","modified":"2026-06-17T01:32:56.31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T14:04:32.929986Z"}],"osv":[{"id":"CVE-2018-1000613","description":"Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.","status":"published","published":"2018-07-09T20:29:00.283Z","modified":"2026-10-20T13:28:31.457806966Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2018-1000613","description":"Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.","status":"published","published":"2018-07-09T20:29:00.283Z","modified":"2026-10-23T18:04:46.401486315Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"GHSA-4446-656p-f54g","title":"Deserialization of Untrusted Data in Bouncy castle","description":"Legion of the Bouncy Castle Java Cryptography APIs starting in version 1.57 and prior to version 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. \n\nThis vulnerability appears to have been fixed in 1.60 and later.","status":"published","published":"2018-10-17T16:23:12Z","modified":"2025-05-12T21:48:36.833343Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-470","CWE-502"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"UBUNTU-CVE-2018-1000613","description":"Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.","status":"published","published":"2018-07-09T20:29:00Z","modified":"2026-03-19T06:52:38.489067Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"MGASA-2018-0376","title":"Updated bouncycastle packages fix security vulnerabilities","description":"Updated bouncycastle packages fix security vulnerabilities:\n\nEnsure full validation of ASN.1 encoding of signature on verification.\nIt was possible to inject extra elements in the sequence making up the\nsignature and still have it validate, which in some cases may have\nallowed the introduction of 'invisible' data into a signed structure\n(CVE-2016-1000338).\n\nPrevent AESEngine key information leak via lookup table accesses\n(CVE-2016-1000339).\n\nPreventcarry propagation bugs in the implementation of squaring for\nseveral raw math classes (CVE-2016-1000340).\n\nDSA signature generation was vulnerable to timing attack. Where timings\ncan be closely observed for the generation of signatures may have allowed\nan attacker to gain information about the signature's k value and\nultimately the private value as well (CVE-2016-1000341).\n\nEnsure that ECDSA does fully validate ASN.1 encoding of signature on\nverification. It was possible to inject extra elements in the sequence\nmaking up the signature and still have it validate, which in some cases\nmay have allowed the introduction of 'invisible' data into a signed\nstructure (CVE-2016-1000342).\n\nPrevent weak default settings for private DSA key pair generation\n(CVE-2016-1000343).\n\nRemoved DHIES from the provider to disable the unsafe usage of ECB mode\n(CVE-2016-1000344).\n\nThe DHIES/ECIES CBC mode was vulnerable to padding oracle attack. In an\nenvironment where timings can be easily observed, it was possible with\nenough observations to identify when the decryption is failing due to\npadding (CVE-2016-1000345).\n\nThe other party DH public key was not fully validated. This could have\ncaused issues as invalid keys could be used to reveal details about the\nother party's private key where static Diffie-Hellman is in use\n(CVE-2016-1000346).\n\nRemove ECIES from the provider to disable the unsafe usage of ECB mode\n(CVE-2016-1000352).\n\nBouncyCastle, when configured to use the JCE (Java Cryptography Extension)\nfor cryptographic functions, provided a weak Bleichenbacher oracle when\nany TLS cipher suite using RSA key exchange was negotiated. An attacker\ncan recover the private key from a vulnerable application. This\nvulnerability is referred to as \"ROBOT\" (CVE-2017-13098).\n\nIt was discovered that the low-level interface to the RSA key pair\ngenerator of Bouncy Castle (a Java implementation of cryptographic\nalgorithms) could perform less Miller-Rabin primality tests than expected\n(CVE-2018-1000180).\n\nFix use of Externally-Controlled Input to Select Classes or Code\n('Unsafe Reflection') (CVE-2018-1000613).\n","status":"published","published":"2018-09-20T23:17:55Z","modified":"2026-04-16T06:24:35.221735775Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2020:0607-1","title":"Security update for bouncycastle","description":"This update for bouncycastle fixes the following issues:\n\nVersion update to 1.60:\n\n* CVE-2018-1000613: Use of Externally-ControlledInput to Select Classes or Code (boo#1100694)\n\n* Release notes:\n    http://www.bouncycastle.org/releasenotes.html\n\nVersion update to 1.59: \n\n* CVE-2017-13098: Fix against Bleichenbacher oracle when not\n  using the lightweight APIs (boo#1072697).\n* Release notes:\n  http://www.bouncycastle.org/releasenotes.html\n\n","status":"published","published":"2020-05-03T16:19:33Z","modified":"2026-02-04T02:49:08.36111Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10661-1","title":"bouncycastle-1.68-3.2 on GA media","description":"These are all security issues fixed in the bouncycastle-1.68-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:35:59.843999Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"ROOT-APP-MAVEN-CVE-2018-1000613","title":"CVE-2018-1000613 in org.bouncycastle:bcprov-jdk15on - Patched by Root","description":"Root has patched CVE-2018-1000613 in the org.bouncycastle:bcprov-jdk15on package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-07T14:06:53Z","modified":"2026-10-07T15:16:07.873720055Z","updated_at":"2026-11-02T15:53:26.76659Z"}]}}