Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2011-2487

The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.

Published

2020-03-11T16:15:11.773

Last Modified

2024-11-21T01:28:23.107

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-327

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	apache	cxf	≤ 2.4.6	Yes
Application	apache	cxf	≤ 2.5.2	Yes
Application	apache	wss4j	< 1.6.5	Yes
Application	redhat	jboss_business_rules_management_system	5.3	Yes
Application	redhat	jboss_enterprise_application_platform	5.0.0	Yes
Application	redhat	jboss_enterprise_application_platform_text-only_advisories	-	Yes
Application	redhat	jboss_enterprise_soa_platform	4.2.0	Yes
Application	redhat	jboss_enterprise_soa_platform	4.3.0	Yes
Application	redhat	jboss_enterprise_web_platform	5.0.0	Yes
Application	redhat	jboss_middleware_text-only_advisories	-	Yes
Application	redhat	jboss_portal	4.0.0	Yes
Application	redhat	jboss_web_services	-	Yes

References

http://cxf.apache.org/note-on-cve-2011-2487.html Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-0191.html Patch, Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-0192.html Patch, Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-0193.html Broken Link, Patch, Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-0194.html Patch, Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-0195.html Patch, Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-0196.html Patch, Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-0198.html Patch, Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-0221.html Patch, Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/57549 Third Party Advisory, VDB Entry ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=713539 Issue Tracking, Patch, Vendor Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/81737 VDB Entry, Vendor Advisory ([email protected])
https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E ([email protected])
https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E ([email protected])
https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E ([email protected])
https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E ([email protected])
https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E ([email protected])
https://www.nds.ruhr-uni-bochum.de/research/publications/breaking-xml-encryption-pkcs15/ Technical Description, Third Party Advisory ([email protected])
http://cxf.apache.org/note-on-cve-2011-2487.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-0191.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-0192.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-0193.html Broken Link, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-0194.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-0195.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-0196.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-0198.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-0221.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/57549 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=713539 Issue Tracking, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/81737 VDB Entry, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://www.nds.ruhr-uni-bochum.de/research/publications/breaking-xml-encryption-pkcs15/ Technical Description, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)