CVE-2019-14887
wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.
Se detectó un fallo cuando un proveedor de seguridad OpenSSL es usado con Wildfly, el valor de "enabled-protocols" en la configuración de Wildfly no es respetado. Un atacante podría apuntar al tráfico enviado desde Wildfly y degradar la conexión a una versión más débil de TLS, rompiendo potencialmente el cifrado. Esto podría conllevar a un filtrado de los datos que son pasados a través de la red. Se cree que Wildfly versiones 7.2.0.GA, 7.2.3.GA y 7.2.5.CR2 son vulnerables.
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-08-10 CVE Reserved
- 2020-03-12 CVE Published
- 2024-01-19 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20200327-0007 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887 | 2021-11-02 | |
| https://access.redhat.com/security/cve/CVE-2019-14887 | 2021-08-11 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1772008 | 2021-08-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Jboss Data Grid Search vendor "Redhat" for product "Jboss Data Grid" | 7.0.0 Search vendor "Redhat" for product "Jboss Data Grid" and version "7.0.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | 7.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.0.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Fuse Search vendor "Redhat" for product "Jboss Fuse" | 7.0.0 Search vendor "Redhat" for product "Jboss Fuse" and version "7.0.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openshift Application Runtimes Search vendor "Redhat" for product "Openshift Application Runtimes" | - | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Single Sign-on Search vendor "Redhat" for product "Single Sign-on" | 7.0 Search vendor "Redhat" for product "Single Sign-on" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Wildfly Search vendor "Redhat" for product "Wildfly" | 7.2.0 Search vendor "Redhat" for product "Wildfly" and version "7.2.0" | general_availability |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Wildfly Search vendor "Redhat" for product "Wildfly" | 7.2.3 Search vendor "Redhat" for product "Wildfly" and version "7.2.3" | general_availability |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Wildfly Search vendor "Redhat" for product "Wildfly" | 7.2.5 Search vendor "Redhat" for product "Wildfly" and version "7.2.5" | cr2 |
Affected
| ||||||