CVE-2019-14887CWE-757

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored

High · published March 16, 2020

CVSS v3.0
7.4
EPSS
1%
Percentile
65.3
In the wild
Unconfirmed
What it is

⚡ An overlooked configuration can expose your data! When Wildfly is paired with OpenSSL, it may allow an attacker to downgrade your connection to weaker TLS protocols, breaking your encryption. 🔥 Think of it like sending a letter in a fancy envelope only for a sneaky postal worker to remove it and send it in a plain, unsealed one instead. The contents of your message are now vulnerable to prying eyes! This flaw could allow attackers to intercept sensitive data, such as login credentials and personal information, during transit. Imagine a thief standing by the mailbox, casually reading your private messages because the envelope was switched to something flimsy. A data leak through this vulnerability could expose confidential information and have serious repercussions for your organization.

Put simply

Think of it like sending a letter in a fancy envelope only for a sneaky postal worker to remove it and send it in a plain, unsealed one instead. The contents of your message are now vulnerable to prying eyes! The vulnerability arises because the 'enabled-protocols' setting in Wildfly isn't respected when using its OpenSSL security provider, permitting a downgrade of the TLS version in use. This weakens encryption and opens the door for potential data leaks.

What to do

This flaw could allow attackers to intercept sensitive data, such as login credentials and personal information, during transit. Imagine a thief standing by the mailbox, casually reading your private messages because the envelope was switched to something flimsy. A data leak through this vulnerability could expose confidential information and have serious repercussions for your organization. To protect your data, immediately update Wildfly to the latest version that addresses this flaw. Review your server configurations to ensure 'enabled-protocols' is appropriately set and enforced. Regularly audit your security settings to prevent similar issues in the future. You've got this! By taking these steps, you'll be reinforcing your defenses and protecting your valuable data! 🛡️

The record
Technical detail
CVSS v3.0
7.4 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01095 · 65.3th percentile
Weakness
CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Published
2020-03-16T14:48Z
EPSS history
Timeline
  • 16 MAR 14:48Z
    A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored
    cvelistv5