CVE-2019-14887
Critical
Description
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Redhat Wildfly
PublishedMar 16, 2020
First seenMar 16, 2020
Weakness typeCWE-757CWE-757
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat wildfly | 7.2.0, 7.2.3, 7.2.5 | — |
| redhat jboss_data_grid | 7.0.0 | — |
| redhat jboss_enterprise_application_platform | 7.0.0 | — |
| redhat jboss_fuse | 7.0.0 | — |
| redhat openshift_application_runtimes | No range specified | — |
| redhat single_sign-on | 7.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.