bouncycastle partially validates ASN1 encoded signatures in ECDSA mode. It is possible to inject extra values into the signatures and still have it validate.
access.redhat.com/errata/RHSA-2018:2669
access.redhat.com/errata/RHSA-2018:2927
github.com/bcgit/bc-java/commit/843c2e60f67d71faf81d236f448ebbe56c62c647#diff-25c3c78db788365f36839b3f2d3016b9
lists.debian.org/debian-lts-announce/2018/07/msg00009.html
security.netapp.com/advisory/ntap-20181127-0004/
usn.ubuntu.com/3727-1/
vigilance.fr/vulnerability/Bouncy-Castle-multiple-vulnerabilities-21455
www.bouncycastle.org/releasenotes.html
www.oracle.com/security-alerts/cpuoct2020.html