CVE-2019-14887

Katalog CVE

CVSS 9.1 · Critical EPSS 1,1%

Kerentanan Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') pada redhat jboss data grid, redhat jboss enterprise application platform +4 lainnya. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.

Rincian

Terbit di NVD

16 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887 issue tracking · advisory vendor
• https://security.netapp.com/advisory/ntap-20200327-0007/ advisory pihak ketiga
• https://issues.redhat.com/browse/JBEAP-17965 permissions required