What’s Vulnerable › Vulnerabilities

CVE-2018-1000613

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-09 · updated 2026-06-17
• Weakness: CWE-470

Description

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.

Affected products

• Legion of the Bouncy Castle Inc. BC-JAVA: from 1.58 before 1.60 — fixed in 1.60
• NetApp OnCommand Workflow Automation: all versions
• openSUSE Leap: 15.1
• Oracle Corporation API Gateway: 11.1.2.4.0
• Oracle Banking Platform: 2.6.0, 2.6.1, 2.6.2
• Oracle Corporation Oracle Business Process Management Suite: 11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0
• Oracle Business Transaction Management: 12.1.0
• Oracle Communications Application Session Controller: 3.7.1, 3.8.0
• Oracle Corporation Oracle Communications Converged Application Server: before 7.0.0.1; 7.0.0.1 — fixed in 7.0.0.1
• Oracle Corporation Communications Convergence: 3.0.2
• Oracle Corporation Communications Diameter Signaling Router (DSR): 8.0.0, 8.1, 8.2, 8.2.1
• Oracle Corporation Communications WebRTC Session Controller: before 7.2; 7.2 — fixed in 7.2
• Oracle Corporation Oracle Data Integrator: 12.2.1.3.0
• Oracle Corporation Enterprise Manager Base Platform: 12.1.0.5.0, 13.2.0.0, 13.3.0.0
• Oracle Enterprise Manager For Fusion Middleware: 13.2.0.0, 13.3.0.0
• Oracle Corporation Enterprise Repository: 11.1.1.7.0, 12.1.3.0.0
• Oracle Corporation Oracle Managed File Transfer: 12.1.3.0.0, 12.2.1.3.0
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.55, 8.56, 8.57
• Oracle Retail Convenience And Fuel Pos Software: 2.8.1
• Oracle Corporation Retail Xstore Point of Service: 7.0, 7.1
• Oracle Corporation Oracle SOA Suite: 12.1.3.0.0, 12.2.1.3.0
• Oracle Corporation Oracle Utilities Network Management System: 1.12.0.3, 2.3.0.0, 2.3.0.1, 2.3.0.2
• Oracle Corporation Oracle WebCenter Portal: 11.1.1.9.0, 12.2.1.3.0
• Oracle WebLogic Server: 12.2.1.3

How to fix

Upgrade to a fixed version: Legion of the Bouncy Castle Inc. BC-JAVA 1.60; Oracle Corporation Oracle Communications Converged Application Server 7.0.0.1; Oracle Corporation Communications WebRTC Session Controller 7.2. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html
• https://github.com/bcgit/bc-java/commit/4092ede58da51af9a21e4825fbad0d9a3ef5a223#diff-2c06e2edef41db889ee14899e12bd574
• https://github.com/bcgit/bc-java/commit/cd98322b171b15b3f88c5ec871175147893c31e6#diff-148a6c098af0199192d6aede960f45dc
• https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
• https://security.netapp.com/advisory/ntap-20190204-0003/
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html

Get alerted when CVE-2018-1000613 or the next vulnerability affects your stack