CVE-2018-1000613

Q: What is the severity of CVE-2018-1000613?

CVE-2018-1000613 has a CVSS score of 9.8 (CRITICAL). This vulnerability in Bouncy Castle Java Cryptography APIs allows remote code execution through unsafe reflection during XMSS/XMSS^MT private key deserialization. Attackers can craft malicious private keys that reference arbitrary classes from the application's classpath, leading to unexpected code execution. Applications using Bouncy Castle 1.58-1.59 for XMSS key operations are affected.

9.8 CRITICAL

Remote Code Execution Deserialization

📋 TL;DR

This vulnerability in Bouncy Castle Java Cryptography APIs allows remote code execution through unsafe reflection during XMSS/XMSS^MT private key deserialization. Attackers can craft malicious private keys that reference arbitrary classes from the application's classpath, leading to unexpected code execution. Applications using Bouncy Castle 1.58-1.59 for XMSS key operations are affected.

💻 Affected Systems

Products:

Bouncy Castle Java Cryptography APIs

Versions: 1.58 up to but not including 1.60

Operating Systems: All platforms running Java

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects XMSS/XMSS^MT private key deserialization functionality. Applications must use these specific key types to be vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full remote code execution with application privileges, potentially leading to complete system compromise, data theft, or lateral movement.

🟠

Likely Case

Remote code execution in applications that deserialize untrusted XMSS private keys, allowing attackers to execute arbitrary code within the application context.

🟢

If Mitigated

Limited impact if proper input validation and sandboxing prevent execution of malicious classes.

🌐 Internet-Facing: HIGH - Applications accepting XMSS private keys from untrusted sources are directly exploitable.

🏢 Internal Only: MEDIUM - Internal systems processing XMSS keys from untrusted sources remain vulnerable.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires crafting malicious XMSS private keys and getting them deserialized by vulnerable applications. No public exploit code is documented.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.60 and later

Vendor Advisory: https://github.com/bcgit/bc-java/commit/4092ede58da51af9a21e4825fbad0d9a3ef5a223

Restart Required: Yes

Instructions:

1. Update Bouncy Castle library to version 1.60 or higher. 2. Replace bcprov-jdk15on-1.58/1.59 JAR files with bcprov-jdk15on-1.60+. 3. Restart all Java applications using Bouncy Castle. 4. Verify no older versions remain in classpath.

🔧 Temporary Workarounds

Disable XMSS key processing

all

Prevent deserialization of XMSS/XMSS^MT private keys if not required

Configure applications to reject XMSS key types
Implement input validation to block XMSS private keys

Classpath restriction

all

Limit available classes in application classpath to reduce attack surface

Use custom classloaders with restricted class access
Implement Java Security Manager policies

🧯 If You Can't Patch

Implement strict input validation to reject untrusted XMSS private keys
Isolate vulnerable applications in network segments with limited access

🔍 How to Verify

Check if Vulnerable:

Check Bouncy Castle version in classpath: find JAR files containing 'bcprov' and verify version is 1.58 or 1.59

Check Version:

java -cp bcprov-jdk15on-*.jar org.bouncycastle.jcajce.provider.BouncyCastleProvider | grep 'BouncyCastle Security Provider'

Verify Fix Applied:

Confirm bcprov-jdk15on-1.60+ JAR files are present and no 1.58/1.59 versions remain

📡 Detection & Monitoring

Log Indicators:

Java exceptions during XMSS key deserialization
ClassNotFound or ClassCast exceptions from Bouncy Castle
Unexpected class loading events

Network Indicators:

Inbound connections delivering binary/key data to applications using Bouncy Castle
Unusual outbound connections after key processing

SIEM Query:

source="*java*" AND ("XMSS" OR "BouncyCastle" OR "ClassNotFoundException")

📊 Metadata

CVE ID: CVE-2018-1000613

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-470

Published: July 9, 2018

Last Updated: May 12, 2025

🔗 References

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html Mailing List,Third Party Advisory
https://github.com/bcgit/bc-java/commit/4092ede58da51af9a21e4825fbad0d9a3ef5a223#diff-2c06e2edef41db889ee14899e12bd574 Patch
https://github.com/bcgit/bc-java/commit/cd98322b171b15b3f88c5ec871175147893c31e6#diff-148a6c098af0199192d6aede960f45dc Patch
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E Mailing List
https://security.netapp.com/advisory/ntap-20190204-0003/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html Mailing List,Third Party Advisory
https://github.com/bcgit/bc-java/commit/4092ede58da51af9a21e4825fbad0d9a3ef5a223#diff-2c06e2edef41db889ee14899e12bd574 Patch
https://github.com/bcgit/bc-java/commit/cd98322b171b15b3f88c5ec871175147893c31e6#diff-148a6c098af0199192d6aede960f45dc Patch
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E Mailing List
https://security.netapp.com/advisory/ntap-20190204-0003/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Api Gateway by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Bc Java by Bouncycastle

Business Process Management Suite by Oracle

Business Process Management Suite by Oracle

Business Process Management Suite by Oracle

Business Transaction Management by Oracle

Communications Application Session Controller by Oracle

Communications Application Session Controller by Oracle

Communications Converged Application Server by Oracle

Communications Converged Application Server by Oracle

Communications Convergence by Oracle

Communications Diameter Signaling Router by Oracle

Communications Diameter Signaling Router by Oracle

Communications Diameter Signaling Router by Oracle

Communications Diameter Signaling Router by Oracle

Communications Webrtc Session Controller by Oracle

Communications Webrtc Session Controller by Oracle

Data Integrator by Oracle

Enterprise Manager Base Platform by Oracle

Enterprise Manager Base Platform by Oracle

Enterprise Manager Base Platform by Oracle

Enterprise Manager For Fusion Middleware by Oracle

Enterprise Manager For Fusion Middleware by Oracle

Enterprise Repository by Oracle

Enterprise Repository by Oracle

Leap by Opensuse

Managed File Transfer by Oracle

Managed File Transfer by Oracle

Oncommand Workflow Automation by Netapp

Peoplesoft Enterprise Peopletools by Oracle

Peoplesoft Enterprise Peopletools by Oracle

Peoplesoft Enterprise Peopletools by Oracle

Retail Convenience And Fuel Pos Software by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Soa Suite by Oracle

Soa Suite by Oracle

Utilities Network Management System by Oracle

Utilities Network Management System by Oracle

Utilities Network Management System by Oracle

Utilities Network Management System by Oracle

Webcenter Portal by Oracle

Webcenter Portal by Oracle

Weblogic Server by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable XMSS key processing

Classpath restriction

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities