Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Bouncy Castle Java library may let attackers alter data

CVE-2018-1000613 · published 4 days ago
Summary

The Bouncy Castle Java cryptography library (bcprov-jdk15on) has a flaw that could let a malicious user modify encrypted information without detection. This affects systems that use the library, such as certain Linux distributions and NetApp automation tools. Update to the latest patched version of the library to close the gap.

What to do
  • Update bouncycastle org.bouncycastle:bcprov-jdk15on to version 1.60.
  • Update org.bouncycastle:bcprov-jdk15on to version 1.60-aikido.1.
  • Update io.root.org.bouncycastle:bcprov-jdk15on to version 1.60-root.io.1.
  • Update bouncycastle bc-java to version 1.60 or later.
  • Update oracle communications_converged_application_server to version 7.0.0.1 or later.
  • Update oracle communications_webrtc_session_controller to version 7.2 or later.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:Pro:18.04:LTS canonical bouncycastle All versions
maven bouncycastle org.bouncycastle:bcprov-jdk15on >= 1.57, < 1.60
Fix: upgrade to 1.60
– bouncycastle bc-java >= 1.58, < 1.60
cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*
– netapp oncommand_workflow_automation All versions
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
– opensuse leap 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
– oracle api_gateway 11.1.2.4.0
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*
– oracle banking_platform 2.6.0
2.6.1
2.6.2
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
– oracle business_process_management_suite 11.1.1.9.0
12.1.3.0.0
12.2.1.3.0
cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:*
– oracle business_transaction_management 12.1.0
cpe:2.3:a:oracle:business_transaction_management:12.1.0:*:*:*:*:*:*:*
– oracle communications_application_session_controller 3.7.1
3.8.0
cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:*
– oracle communications_converged_application_server < 7.0.0.1
7.0.0.1
cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*
– oracle communications_convergence 3.0.2
cpe:2.3:a:oracle:communications_convergence:3.0.2:*:*:*:*:*:*:*
– oracle communications_diameter_signaling_router 8.0.0
8.1
8.2
8.2.1
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:*
– oracle communications_webrtc_session_controller < 7.2
7.2
cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:*
– oracle data_integrator 12.2.1.3.0
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*
– oracle enterprise_manager_base_platform 12.1.0.5.0
13.2.0.0
13.3.0.0
cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:*:*:*:*:*:*:*
– oracle enterprise_manager_for_fusion_middleware 13.2.0.0
13.3.0.0
cpe:2.3:a:oracle:enterprise_manager_for_fusion_middleware:13.2.0.0:*:*:*:*:*:*:*
– oracle enterprise_repository 11.1.1.7.0
12.1.3.0.0
cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*
– oracle managed_file_transfer 12.1.3.0.0
12.2.1.3.0
cpe:2.3:a:oracle:managed_file_transfer:12.1.3.0.0:*:*:*:*:*:*:*
– oracle peoplesoft_enterprise_peopletools 8.55
8.56
8.57
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*
– oracle retail_convenience_and_fuel_pos_software 2.8.1
cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.8.1:*:*:*:*:*:*:*
– oracle retail_xstore_point_of_service 7.0
7.1
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:*
– oracle soa_suite 12.1.3.0.0
12.2.1.3.0
cpe:2.3:a:oracle:soa_suite:12.1.3.0.0:*:*:*:*:*:*:*
– oracle utilities_network_management_system 1.12.0.3
2.3.0.0
2.3.0.1
2.3.0.2
cpe:2.3:a:oracle:utilities_network_management_system:1.12.0.3:*:*:*:*:*:*:*
– oracle webcenter_portal 11.1.1.9.0
12.2.1.3.0
cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*
– oracle weblogic_server 12.2.1.3
cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*
Root:Maven – org.bouncycastle:bcprov-jdk15on < 1.60-aikido.1
Fix: upgrade to 1.60-aikido.1
Root:Maven – io.root.org.bouncycastle:bcprov-jdk15on < 1.60-root.io.1
Fix: upgrade to 1.60-root.io.1
Original advisory text
CVE-2018-1000613 in org.bouncycastle:bcprov-jdk15on - Patched by Root
Root has patched CVE-2018-1000613 in the org.bouncycastle:bcprov-jdk15on package for Root:Maven. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-502Deserialization of Untrusted Data
Timeline
Published7 Oct 2026
Updated12 Oct 2026
First seen6 Mar 2026
Sources
UBUNTU-CVE-2018-1000613 · OSV
GHSA-4446-656p-f54g · GHSA
CVE-2018-1000613 · NVD
ROOT-APP-MAVEN-CVE-2018-1000613 · OSV
Track software like this
Free during beta