Read the docs
TI-2018-15967 Aliases CVE-2018-1000613GHSA-4446-656p-f54g

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to…

Priority MEDIUM 56CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04767 91st percentileScored 2026-11-07
Fix Partial org.bouncycastle:bcprov-jdk15on (Maven): 1.60Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.bouncycastle:bcprov-jdk15on (Maven)1.57 to before 1.601.60Patch availableGHSA-4446-656p-f54g
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.bouncycastle:bcprov-jdk15on (Maven) Vendor— Affected 1.57 to before 1.60 Fixed in 1.60 Patch available GHSA-4446-656p-f54g

CPE configurations NVD · 47

CPEVersionsRoleVendor
cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*1.58 to before 1.60VulnerableLegion of the Bouncy Castle Inc.
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*11.1.2.4.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
  • cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:* Versions 1.58 to before 1.60 Vulnerable ·Legion of the Bouncy Castle Inc.
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* Versions 11.1.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
Show 37 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:business_transaction_management:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:*3.7.1VulnerableOracle
cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:*3.8.0VulnerableOracle
cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*before 7.0.0.1VulnerableOracle
cpe:2.3:a:oracle:communications_converged_application_server:7.0.0.1:*:*:*:*:*:*:*7.0.0.1VulnerableOracle
cpe:2.3:a:oracle:communications_convergence:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:*8.2VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:*8.2.1VulnerableOracle
cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:*before 7.2VulnerableOracle
cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*7.2VulnerableOracle
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:*:*:*:*:*:*:*12.1.0.5.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0:*:*:*:*:*:*:*13.2.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*13.3.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_fusion_middleware:13.2.0.0:*:*:*:*:*:*:*13.2.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_fusion_middleware:13.3.0.0:*:*:*:*:*:*:*13.3.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*11.1.1.7.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*8.55VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*8.56VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.8.1:*:*:*:*:*:*:*2.8.1VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:soa_suite:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:soa_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:utilities_network_management_system:1.12.0.3:*:*:*:*:*:*:*1.12.0.3VulnerableOracle
cpe:2.3:a:oracle:utilities_network_management_system:2.3.0.0:*:*:*:*:*:*:*2.3.0.0VulnerableOracle
cpe:2.3:a:oracle:utilities_network_management_system:2.3.0.1:*:*:*:*:*:*:*2.3.0.1VulnerableOracle
cpe:2.3:a:oracle:utilities_network_management_system:2.3.0.2:*:*:*:*:*:*:*2.3.0.2VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*12.2.1.3VulnerableOracle
  • cpe:2.3:a:oracle:business_transaction_management:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:* Versions 3.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:* Versions 3.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:* Versions before 7.0.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_converged_application_server:7.0.0.1:*:*:*:*:*:*:* Versions 7.0.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_convergence:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:* Versions 8.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:* Versions before 7.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:*:*:*:*:*:*:* Versions 12.1.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0:*:*:*:*:*:*:* Versions 13.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* Versions 13.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_fusion_middleware:13.2.0.0:*:*:*:*:*:*:* Versions 13.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_fusion_middleware:13.3.0.0:*:*:*:*:*:*:* Versions 13.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:* Versions 11.1.1.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* Versions 8.55 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.8.1:*:*:*:*:*:*:* Versions 2.8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:soa_suite:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:soa_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_network_management_system:1.12.0.3:*:*:*:*:*:*:* Versions 1.12.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_network_management_system:2.3.0.0:*:*:*:*:*:*:* Versions 2.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_network_management_system:2.3.0.1:*:*:*:*:*:*:* Versions 2.3.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_network_management_system:2.3.0.2:*:*:*:*:*:*:* Versions 2.3.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:* Versions 12.2.1.3 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-4446-656p-f54g org.bouncycastle:bcprov-jdk15on (Maven) Fixed in 1.60 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Will not fix
Not affected: 8 products
  • JBoss Developer Studio 11
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Fuse 6
  • Red Hat Satellite 6
  • Red Hat Software Collections
  • Red Hat Subscription Asset Manager
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1000613
  2. 2026-10-03 Alias added: GHSA-4446-656p-f54g

References

Patch 8

Advisory 4

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences