CVE-2019-14887

Published: Mar 16, 2020Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.

Affected (8)

Products: Redhat: Jboss Data Grid, Jboss Enterprise Application Platform, Jboss Fuse, Openshift Application Runtimes, Single Sign On, Wildfly

Redhat

6 products

Jboss Data Grid

Jboss Enterprise Application Platform

Jboss Fuse

Openshift Application Runtimes

Single Sign On

Wildfly

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Data Grid	Version 7.0.0
Redhat Jboss Enterprise Application Platform	Version 7.0.0
Redhat Jboss Fuse	Version 7.0.0
Redhat Openshift Application Runtimes	All versions
Redhat Single Sign On	Version 7.0
Redhat Wildfly	Version 7.2.0 general_availability
Redhat Wildfly	Version 7.2.3 general_availability
Redhat Wildfly	Version 7.2.5 cr2