CVE-2019-14887 — CRITICAL (9.1)

Vulnerability Description

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Jboss Data Grid	7.0.0
Redhat	Jboss Enterprise Application Platform	7.0.0
Redhat	Jboss Fuse	7.0.0
Redhat	Openshift Application Runtimes	-
Redhat	Single Sign-On	7.0
Redhat	Wildfly	7.2.0

Related Weaknesses (CWE)

CWE-757

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887Issue TrackingVendor Advisory
https://issues.redhat.com/browse/JBEAP-17965Permissions Required
https://security.netapp.com/advisory/ntap-20200327-0007/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887Issue TrackingVendor Advisory
https://issues.redhat.com/browse/JBEAP-17965Permissions Required
https://security.netapp.com/advisory/ntap-20200327-0007/Third Party Advisory

FAQ

What is CVE-2019-14887?

CVE-2019-14887 is a vulnerability with a CVSS score of 9.1 (CRITICAL). A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfl...

How severe is CVE-2019-14887?

CVE-2019-14887 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2019-14887?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Jboss Data Grid, Redhat Jboss Enterprise Application Platform, Redhat Jboss Fuse, Redhat Openshift Application Runtimes, Redhat Single Sign-On.