CVE-2011-2487 Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J
MediumCVSS 5.9
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.ws.security/wss4j(Maven) | < 1.6.5 | 1.6.5 |
| org.apache.ws.security/wss4j(Maven) | = 1.5.10 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.11 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.12 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.2 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.3 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.4 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.5 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.6 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.7 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.8 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.9 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.0 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.1 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.2 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.3 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.4 | No fix listed |
| wss4j/wss4j(Maven) | < 1.6.5 | 1.6.5 |
| wss4j/wss4j(Maven) | = 1.5.0 | No fix listed |
| wss4j/wss4j(Maven) | = 1.5.1 | No fix listed |
| apache cxf | >= 2.4.0, <= 2.4.6 | No fix listed |
| apache cxf | >= 2.5.0, <= 2.5.2 | No fix listed |
| apache wss4j | < 1.6.5 | 1.6.5 |
| redhat jboss business rules management system | = 5.3 | No fix listed |
| redhat jboss enterprise application platform | = 5.0.0 | No fix listed |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat jboss enterprise application platform text-only advisories | All versions | No fix listed |
| redhat jboss enterprise soa platform | = 4.2.0 | No fix listed |
| redhat jboss enterprise soa platform | = 4.3.0 | No fix listed |
| redhat jboss enterprise web platform | = 5.0.0 | No fix listed |
| redhat jboss middleware text-only advisories | All versions | No fix listed |
| redhat jboss portal | = 4.0.0 | No fix listed |
| redhat jboss web services | All versions | No fix listed |
| apache wss4j | = before 1.6.5 | No fix listed |
| redhat JBossWS | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- www.nds.ruhr-uni-bochum.de technical-description third-party-advisory
- web.archive.org
- lists.apache.org
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html mailing-list
- lists.apache.org
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html mailing-list
- lists.apache.org
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html mailing-list
- lists.apache.org
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html mailing-list
- lists.apache.org
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
- exchange.xforce.ibmcloud.com vdb-entry vendor-advisory
- bugzilla.redhat.com issue-tracking patch vendor-advisory
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- cxf.apache.org vendor-advisory
- rhn.redhat.com patch vendor-advisory
- rhn.redhat.com patch vendor-advisory
- rhn.redhat.com broken-link patch vendor-advisory
- rhn.redhat.com patch vendor-advisory
- rhn.redhat.com patch vendor-advisory
- rhn.redhat.com patch vendor-advisory
- rhn.redhat.com patch vendor-advisory
- rhn.redhat.com patch vendor-advisory
- github.com
- www.securityfocus.com third-party-advisory vdb-entry