CVE-2019-14887

CWE-757CWE-3265 documents5 sources
Severity
9.1CRITICAL
EPSS
0.2%
top 54.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
RED HAT WildflyRedhat Jboss Data GridRedhat Jboss Enterprise Application Platform+3 more
Timeline
PublishedMar 16
Latest updateFeb 15

Description

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages6 packages

▶NVDredhat/wildfly7.2.0, 7.2.3, 7.2.5+2
▶CVEListV5red_hat/wildfly7.2.0.GA, 7.2.3.GA, 7.2.5.CR2

🔴Vulnerability Details

2
GHSA
Inadequate Encryption Strength and Algorithm Downgrade in Wildfly↗2022-02-15
▶
CVEList
CVE-2019-14887: A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored↗2020-03-16
▶

📋Vendor Advisories

1
Red Hat
wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use↗2020-03-12
▶

💬Community

1
Bugzilla
CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use↗2019-11-13
▶