{"action":"Upgrade bouncycastle to 1.60-1 or later.","affected":[{"fixed":"1.60-1","introduced":"0"}],"component":"bouncycastle","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1.60-1"],"id":"tcs_01M5NCV7RPMTWWXPQEJXT73H4Q","modified_at":"2026-10-23T18:04:46.401486315Z","published_at":"2018-07-09T20:29:00.283Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000613","https://security-tracker.debian.org/tracker/CVE-2018-1000613"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2018-1000613#Debian:13/bouncycastle","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000613"}],"summary":"Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsa"}