CVE-2011-2487: Medium severity apache cxf vulnerability

Published Jun 15, 2011
·
Updated

A flaw was found in JBoss web services where the services used a weak symmetric encryption protocol, PKCS#1 v1.5. An attacker could use this weakness in chosen-ciphertext attacks to recover the symmetric key and conduct further attacks.

Other sources

It was found that JBossWS, a J2EE Web Services server, leaked further channel data, by using PKCS#1 v1.5 protocol family / public key encryption scheme in order to distribute the symmetric key. A remote attacker, aware of a cryptographic weakness of the PKCS#1 v1.5 public key encryption scheme, could use this flaw to conduct chosen-encrypted-key attacks, leading to the recovery of the entire plaintext form of the intended symmetric key, to be distributed, by examining of the differences between SOAP responses, sent from JBossWS server.

Acknowledgements:

Red Hat would like to thank Juraj Somorovsky of Ruhr-University Bochum for reporting this issue.

— Red Hat

The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.

Affected Software

237 affected componentsFixes available
redhat/aopalliance<0:1.0-5.2.jdk6.ep5.el5
0:1.0-5.2.jdk6.ep5.el5
redhat/apache-cxf<0:2.2.12-6.1.patch_04.ep5.el5
0:2.2.12-6.1.patch_04.ep5.el5
redhat/bsh2<0:2.0-0.b4.15.1.patch01.ep5.el5
0:2.0-0.b4.15.1.patch01.ep5.el5
redhat/glassfish-jaxb<0:2.1.12-12_patch_03.ep5.el5
0:2.1.12-12_patch_03.ep5.el5
redhat/google-guice<0:2.0-3.ep5.el5
0:2.0-3.ep5.el5
redhat/hibernate3<1:3.3.2-1.5.GA_CP05.ep5.el5
1:3.3.2-1.5.GA_CP05.ep5.el5
redhat/hibernate3-annotations<0:3.4.0-3.3.GA_CP05.ep5.el5
0:3.4.0-3.3.GA_CP05.ep5.el5
redhat/hibernate3-entitymanager<0:3.4.0-4.4.GA_CP05.ep5.el5
0:3.4.0-4.4.GA_CP05.ep5.el5
redhat/hibernate3-search<0:3.1.1-2.4.GA_CP05.ep5.el5
0:3.1.1-2.4.GA_CP05.ep5.el5
redhat/jacorb-jboss<0:2.3.2-2.jboss_1.ep5.el5
0:2.3.2-2.jboss_1.ep5.el5
redhat/javassist<0:3.12.0-6.SP1.ep5.el5
0:3.12.0-6.SP1.ep5.el5
redhat/jboss-aop2<0:2.1.6-5.CP06.ep5.el5
0:2.1.6-5.CP06.ep5.el5
redhat/jbossas-web<0:5.2.0-8.ep5.el5
0:5.2.0-8.ep5.el5
redhat/jbossas-web-tp-licenses<0:5.2.0-7.ep5.el5
0:5.2.0-7.ep5.el5
redhat/jbossas-ws-cxf-ewp<0:5.2.0-7.ep5.el5
0:5.2.0-7.ep5.el5
redhat/jboss-bootstrap<0:1.0.2-1.ep5.el5
0:1.0.2-1.ep5.el5
redhat/jboss-cache-core<0:3.2.11-1.GA.ep5.el5
0:3.2.11-1.GA.ep5.el5
redhat/jboss-cache-pojo<0:3.0.1-1.1.ep5.el5
0:3.0.1-1.1.ep5.el5
redhat/jboss-cl<0:2.0.11-1.GA.ep5.el5
0:2.0.11-1.GA.ep5.el5
redhat/jboss-cluster-ha-server-api<0:1.2.1-2.ep5.el5
0:1.2.1-2.ep5.el5
redhat/jboss-common-beans<0:1.0.1-2.1.Final.ep5.el5
0:1.0.1-2.1.Final.ep5.el5
redhat/jboss-common-core<0:2.2.21-1.ep5.el5
0:2.2.21-1.ep5.el5
redhat/jboss-eap5-native<0:5.2.0-6.ep5.el5
0:5.2.0-6.ep5.el5
redhat/jboss-ejb3-cache<0:1.0.0-4.ep5.el5
0:1.0.0-4.ep5.el5
redhat/jboss-ejb3-core<0:1.3.9-0.4.ep5.el5
0:1.3.9-0.4.ep5.el5
redhat/jboss-ejb3-ext-api<0:1.0.0-4.1.ep5.el5
0:1.0.0-4.1.ep5.el5
redhat/jboss-ejb3-ext-api-impl<0:1.0.0-3.7.ep5.el5
0:1.0.0-3.7.ep5.el5
redhat/jboss-ejb3-interceptors<0:1.0.9-0.1.ep5.el5
0:1.0.9-0.1.ep5.el5
redhat/jboss-ejb3-metadata<0:1.0.0-3.ep5.el5
0:1.0.0-3.ep5.el5
redhat/jboss-ejb3-metrics-deployer<0:1.1.1-0.1.ep5.el5
0:1.1.1-0.1.ep5.el5
redhat/jboss-ejb3-security<0:1.0.2-0.5.ep5.el5
0:1.0.2-0.5.ep5.el5
redhat/jboss-ejb3-timeout<0:0.1.1-0.5.ep5.el5
0:0.1.1-0.5.ep5.el5
redhat/jboss-ejb3-transactions<0:1.0.2-1.4.ep5.el5
0:1.0.2-1.4.ep5.el5
redhat/jboss-javaee<0:5.0.2-2.ep5.el5
0:5.0.2-2.ep5.el5
redhat/jboss-jpa-deployers<0:1.0.0-6.1SP2.ep5.el5
0:1.0.0-6.1SP2.ep5.el5
redhat/jboss-logmanager<0:1.1.2-6.GA_patch_01.ep5.el5
0:1.1.2-6.GA_patch_01.ep5.el5
redhat/jboss-naming<0:5.0.3-5.1.CP02.ep5.el5
0:5.0.3-5.1.CP02.ep5.el5
redhat/jboss-reflect<0:2.0.4-2.1.ep5.el5
0:2.0.4-2.1.ep5.el5
redhat/jboss-remoting<0:2.5.4-10.SP4.1.ep5.el5
0:2.5.4-10.SP4.1.ep5.el5
redhat/jboss-seam2<0:2.2.6.EAP5-10.ep5.el5
0:2.2.6.EAP5-10.ep5.el5
redhat/jboss-security-negotiation<0:2.1.3-1.GA.ep5.el5
0:2.1.3-1.GA.ep5.el5
redhat/jboss-security-spi<1:2.0.5-4.SP3_1.ep5.el5
1:2.0.5-4.SP3_1.ep5.el5
redhat/jbosssx2<0:2.0.5-8.SP3_1.ep5.el5
0:2.0.5-8.SP3_1.ep5.el5
redhat/jbossts<1:4.6.1-12.CP13.8.ep5.el5
1:4.6.1-12.CP13.8.ep5.el5
redhat/jboss-vfs2<0:2.2.1-4.GA.ep5.el5
0:2.2.1-4.GA.ep5.el5
redhat/jbossweb<0:2.1.13-2_patch_01.ep5.el5
0:2.1.13-2_patch_01.ep5.el5
redhat/jbossws<0:3.1.2-13.SP15_patch_01.ep5.el5
0:3.1.2-13.SP15_patch_01.ep5.el5
redhat/jbossws-common<0:1.1.0-9.SP10.ep5.el5
0:1.1.0-9.SP10.ep5.el5
redhat/jbossws-framework<0:3.1.2-9.SP13.ep5.el5
0:3.1.2-9.SP13.ep5.el5
redhat/jbossws-spi<0:1.1.2-6.SP8.ep5.el5
0:1.1.2-6.SP8.ep5.el5
redhat/jgroups<1:2.6.22-1.ep5.el5
1:2.6.22-1.ep5.el5
redhat/jopr-embedded<0:1.3.4-19.SP6.9.ep5.el5
0:1.3.4-19.SP6.9.ep5.el5
redhat/jopr-hibernate-plugin<0:3.0.0-14.EmbJopr5.ep5.el5
0:3.0.0-14.EmbJopr5.ep5.el5
redhat/jopr-jboss-as<5-plugin-0:3.0.0-14.EmbJopr5.ep5.el5
5-plugin-0:3.0.0-14.EmbJopr5.ep5.el5
redhat/jopr-jboss-cache-v3-plugin<0:3.0.0-15.EmbJopr5.ep5.el5
0:3.0.0-15.EmbJopr5.ep5.el5
redhat/picketlink-federation<0:2.1.5-3.ep5.el5
0:2.1.5-3.ep5.el5
redhat/picketlink-quickstarts<0:2.1.5-1.ep5.el5
0:2.1.5-1.ep5.el5
redhat/resteasy<0:1.2.1-18.CP02_patch02.1.ep5.el5
0:1.2.1-18.CP02_patch02.1.ep5.el5
redhat/rh-ewp-docs<0:5.2.0-6.ep5.el5
0:5.2.0-6.ep5.el5
redhat/rhq<0:3.0.0-21.EmbJopr5.ep5.el5
0:3.0.0-21.EmbJopr5.ep5.el5
redhat/rhq-jmx-plugin<0:3.0.0-21.EmbJopr5.ep5.el5
0:3.0.0-21.EmbJopr5.ep5.el5
redhat/rhq-platform-plugin<0:3.0.0-14.EmbJopr5.ep5.el5
0:3.0.0-14.EmbJopr5.ep5.el5
redhat/spring2<0:2.5.6-9.SEC03.1.ep5.el5
0:2.5.6-9.SEC03.1.ep5.el5
redhat/wss4j<0:1.5.12-4.1_patch_02.ep5.el5
0:1.5.12-4.1_patch_02.ep5.el5
redhat/xerces-j2<0:2.9.1-10.patch02.ep5.el5
0:2.9.1-10.patch02.ep5.el5
redhat/xml-commons<0:1.3.04-8.2_patch_01.ep5.el5
0:1.3.04-8.2_patch_01.ep5.el5
redhat/xml-security<0:1.5.1-2.ep5.el5
0:1.5.1-2.ep5.el5
redhat/aopalliance<0:1.0-5.3.ep5.el6
0:1.0-5.3.ep5.el6
redhat/apache-cxf<0:2.2.12-6.1.patch_04.ep5.el6
0:2.2.12-6.1.patch_04.ep5.el6
redhat/bsh2<0:2.0-0.b4.15.patch01.ep5.el6
0:2.0-0.b4.15.patch01.ep5.el6
redhat/glassfish-jaxb<0:2.1.12-12_patch_03.ep5.el6
0:2.1.12-12_patch_03.ep5.el6
redhat/google-guice<0:2.0-3.ep5.el6
0:2.0-3.ep5.el6
redhat/hibernate3<1:3.3.2-1.9.GA_CP05.ep5.el6
1:3.3.2-1.9.GA_CP05.ep5.el6
redhat/hibernate3-annotations<0:3.4.0-3.6.GA_CP05.ep5.el6
0:3.4.0-3.6.GA_CP05.ep5.el6
redhat/hibernate3-entitymanager<0:3.4.0-4.5.GA_CP05.ep5.el6
0:3.4.0-4.5.GA_CP05.ep5.el6
redhat/hibernate3-search<0:3.1.1-2.5.GA_CP05.ep5.el6
0:3.1.1-2.5.GA_CP05.ep5.el6
redhat/hsqldb<2:1.8.0.10-11_patch_01.1.ep5.el6
2:1.8.0.10-11_patch_01.1.ep5.el6
redhat/jacorb-jboss<0:2.3.2-2.jboss_1.ep5.el6
0:2.3.2-2.jboss_1.ep5.el6
redhat/javassist<0:3.12.0-6.SP1.ep5.el6
0:3.12.0-6.SP1.ep5.el6
redhat/jboss-aop2<0:2.1.6-5.CP06.ep5.el6
0:2.1.6-5.CP06.ep5.el6
redhat/jbossas-web<0:5.2.0-16.ep5.el6
0:5.2.0-16.ep5.el6
redhat/jbossas-web-tp-licenses<0:5.2.0-8.ep5.el6
0:5.2.0-8.ep5.el6
redhat/jbossas-ws-cxf-ewp<0:5.2.0-11.ep5.el6
0:5.2.0-11.ep5.el6
redhat/jboss-bootstrap<0:1.0.2-1.ep5.el6
0:1.0.2-1.ep5.el6
redhat/jboss-cache-core<0:3.2.11-1.GA.ep5.el6
0:3.2.11-1.GA.ep5.el6
redhat/jboss-cache-pojo<0:3.0.1-1.ep5.el6
0:3.0.1-1.ep5.el6
redhat/jboss-cl<0:2.0.11-4.GA.ep5.el6
0:2.0.11-4.GA.ep5.el6
redhat/jboss-cluster-ha-server-api<0:1.2.1-2.ep5.el6
0:1.2.1-2.ep5.el6
redhat/jboss-common-beans<0:1.0.1-2.Final.ep5.el6
0:1.0.1-2.Final.ep5.el6
redhat/jboss-common-core<0:2.2.21-1.ep5.el6
0:2.2.21-1.ep5.el6
redhat/jboss-eap5-native<0:5.2.0-6.ep5.el6
0:5.2.0-6.ep5.el6
redhat/jboss-ejb3-cache<0:1.0.0-4.ep5.el6
0:1.0.0-4.ep5.el6
redhat/jboss-ejb3-core<0:1.3.9-0.4.ep5.el6
0:1.3.9-0.4.ep5.el6
redhat/jboss-ejb3-ext-api<0:1.0.0-4.1.ep5.el6
0:1.0.0-4.1.ep5.el6
redhat/jboss-ejb3-ext-api-impl<0:1.0.0-3.7.ep5.el6
0:1.0.0-3.7.ep5.el6
redhat/jboss-ejb3-interceptors<0:1.0.9-0.2.ep5.el6
0:1.0.9-0.2.ep5.el6
redhat/jboss-ejb3-metadata<0:1.0.0-3.ep5.el6
0:1.0.0-3.ep5.el6
redhat/jboss-ejb3-metrics-deployer<0:1.1.1-0.1.ep5.el6
0:1.1.1-0.1.ep5.el6
redhat/jboss-ejb3-security<0:1.0.2-0.5.ep5.el6
0:1.0.2-0.5.ep5.el6
redhat/jboss-ejb3-timeout<0:0.1.1-0.8.ep5.el6
0:0.1.1-0.8.ep5.el6
redhat/jboss-ejb3-transactions<0:1.0.2-1.6.ep5.el6
0:1.0.2-1.6.ep5.el6
redhat/jboss-javaee<0:5.0.2-2.ep5.el6
0:5.0.2-2.ep5.el6
redhat/jboss-jpa-deployers<0:1.0.0-6.SP2.ep5.el6
0:1.0.0-6.SP2.ep5.el6
redhat/jboss-logmanager<0:1.1.2-6.GA_patch_01.ep5.el6
0:1.1.2-6.GA_patch_01.ep5.el6
redhat/jboss-naming<0:5.0.3-5.CP02.ep5.el6
0:5.0.3-5.CP02.ep5.el6
redhat/jboss-reflect<0:2.0.4-2.ep5.el6
0:2.0.4-2.ep5.el6
redhat/jboss-remoting<0:2.5.4-10.SP4.1.ep5.el6
0:2.5.4-10.SP4.1.ep5.el6
redhat/jboss-seam2<0:2.2.6.EAP5-14.ep5.el6
0:2.2.6.EAP5-14.ep5.el6
redhat/jboss-security-negotiation<0:2.1.3-1.GA.ep5.el6
0:2.1.3-1.GA.ep5.el6
redhat/jboss-security-spi<1:2.0.5-4.SP3_1.ep5.el6
1:2.0.5-4.SP3_1.ep5.el6
redhat/jbosssx2<0:2.0.5-8.3.SP3_1.ep5.el6
0:2.0.5-8.3.SP3_1.ep5.el6
redhat/jbossts<1:4.6.1-12.CP13.7.ep5.el6
1:4.6.1-12.CP13.7.ep5.el6
redhat/jboss-vfs2<0:2.2.1-4.GA.ep5.el6
0:2.2.1-4.GA.ep5.el6
redhat/jbossweb<0:2.1.13-2_patch_01.ep5.el6
0:2.1.13-2_patch_01.ep5.el6
redhat/jbossws<0:3.1.2-13.SP15_patch_01.ep5.el6
0:3.1.2-13.SP15_patch_01.ep5.el6
redhat/jbossws-common<0:1.1.0-9.SP10.ep5.el6
0:1.1.0-9.SP10.ep5.el6
redhat/jbossws-framework<0:3.1.2-9.SP13.ep5.el6
0:3.1.2-9.SP13.ep5.el6
redhat/jbossws-spi<0:1.1.2-6.SP8.ep5.el6
0:1.1.2-6.SP8.ep5.el6
redhat/jgroups<1:2.6.22-1.ep5.el6
1:2.6.22-1.ep5.el6
redhat/jopr-embedded<0:1.3.4-19.SP6.9.ep5.el6
0:1.3.4-19.SP6.9.ep5.el6
redhat/jopr-hibernate-plugin<0:3.0.0-14.EmbJopr5.ep5.el6
0:3.0.0-14.EmbJopr5.ep5.el6
redhat/jopr-jboss-as<5-plugin-0:3.0.0-16.EmbJopr5.ep5.el6
5-plugin-0:3.0.0-16.EmbJopr5.ep5.el6
redhat/jopr-jboss-cache-v3-plugin<0:3.0.0-15.EmbJopr5.ep5.el6
0:3.0.0-15.EmbJopr5.ep5.el6
redhat/picketlink-federation<0:2.1.5-3.ep5.el6
0:2.1.5-3.ep5.el6
redhat/picketlink-quickstarts<0:2.1.5-1.ep5.el6
0:2.1.5-1.ep5.el6
redhat/resteasy<0:1.2.1-17.CP02_patch02.1.ep5.el6
0:1.2.1-17.CP02_patch02.1.ep5.el6
redhat/rh-ewp-docs<0:5.2.0-11.ep5.el6
0:5.2.0-11.ep5.el6
redhat/rhq<0:3.0.0-21.EmbJopr5.ep5.el6
0:3.0.0-21.EmbJopr5.ep5.el6
redhat/rhq-jmx-plugin<0:3.0.0-21.EmbJopr5.ep5.el6
0:3.0.0-21.EmbJopr5.ep5.el6
redhat/rhq-platform-plugin<0:3.0.0-14.EmbJopr5.ep5.el6
0:3.0.0-14.EmbJopr5.ep5.el6
redhat/spring2<0:2.5.6-9.SEC03.1.ep5.el6
0:2.5.6-9.SEC03.1.ep5.el6
redhat/wss4j<0:1.5.12-4_patch_02.ep5.el6
0:1.5.12-4_patch_02.ep5.el6
redhat/xerces-j2<0:2.9.1-10.patch02.ep5.el6
0:2.9.1-10.patch02.ep5.el6
redhat/xml-commons<0:1.3.04-8.2_patch_01.ep5.el6
0:1.3.04-8.2_patch_01.ep5.el6
redhat/xml-security<0:1.5.1-2.ep5.el6
0:1.5.1-2.ep5.el6
redhat/aopalliance<0:1.0-5.2.jdk6.ep5.el4
0:1.0-5.2.jdk6.ep5.el4
redhat/apache-cxf<0:2.2.12-6.1.patch_04.ep5.el4
0:2.2.12-6.1.patch_04.ep5.el4
redhat/bsh2<0:2.0-0.b4.15.1.patch01.ep5.el4
0:2.0-0.b4.15.1.patch01.ep5.el4
redhat/glassfish-jaxb<0:2.1.12-12_patch_03.ep5.el4
0:2.1.12-12_patch_03.ep5.el4
redhat/google-guice<0:2.0-3.ep5.el4
0:2.0-3.ep5.el4
redhat/hibernate3<1:3.3.2-1.6.GA_CP05.ep5.el4
1:3.3.2-1.6.GA_CP05.ep5.el4
redhat/hibernate3-annotations<0:3.4.0-3.4.GA_CP05.ep5.el4
0:3.4.0-3.4.GA_CP05.ep5.el4
redhat/hibernate3-entitymanager<0:3.4.0-4.4.GA_CP05.ep5.el4
0:3.4.0-4.4.GA_CP05.ep5.el4
redhat/hibernate3-search<0:3.1.1-2.3.GA_CP05.ep5.el4
0:3.1.1-2.3.GA_CP05.ep5.el4
redhat/hornetq<0:2.2.24-1.EAP.GA.ep5.el4
0:2.2.24-1.EAP.GA.ep5.el4
redhat/hornetq-native<0:2.2.20-1.EAP.GA.1.ep5.el4
0:2.2.20-1.EAP.GA.1.ep5.el4
redhat/jacorb-jboss<0:2.3.2-2.jboss_1.ep5.el4
0:2.3.2-2.jboss_1.ep5.el4
redhat/javassist<0:3.12.0-6.SP1.ep5.el4
0:3.12.0-6.SP1.ep5.el4
redhat/jboss-aop2<0:2.1.6-5.CP06.ep5.el4
0:2.1.6-5.CP06.ep5.el4
redhat/jbossas<0:5.2.0-14.ep5.el4
0:5.2.0-14.ep5.el4
redhat/jbossas-hornetq<0:5.2.0-6.ep5.el4
0:5.2.0-6.ep5.el4
redhat/jbossas-tp-licenses<0:5.2.0-7.ep5.el4
0:5.2.0-7.ep5.el4
redhat/jbossas-ws-cxf<0:5.2.0-8.ep5.el4
0:5.2.0-8.ep5.el4
redhat/jboss-bootstrap<0:1.0.2-1.ep5.el4
0:1.0.2-1.ep5.el4
redhat/jboss-cache-core<0:3.2.11-1.GA.ep5.el4
0:3.2.11-1.GA.ep5.el4
redhat/jboss-cache-pojo<0:3.0.1-1.1.ep5.el4
0:3.0.1-1.1.ep5.el4
redhat/jboss-cl<0:2.0.11-1.GA.ep5.el4
0:2.0.11-1.GA.ep5.el4
redhat/jboss-cluster-ha-server-api<0:1.2.1-2.ep5.el4
0:1.2.1-2.ep5.el4
redhat/jboss-common-beans<0:1.0.1-2.1.Final.ep5.el4
0:1.0.1-2.1.Final.ep5.el4
redhat/jboss-common-core<0:2.2.21-1.ep5.el4
0:2.2.21-1.ep5.el4
redhat/jboss-eap5-native<0:5.2.0-6.ep5.el4
0:5.2.0-6.ep5.el4
redhat/jboss-ejb3-cache<0:1.0.0-4.ep5.el4
0:1.0.0-4.ep5.el4
redhat/jboss-ejb3-core<0:1.3.9-0.4.ep5.el4
0:1.3.9-0.4.ep5.el4
redhat/jboss-ejb3-ext-api<0:1.0.0-4.1.ep5.el4
0:1.0.0-4.1.ep5.el4
redhat/jboss-ejb3-ext-api-impl<0:1.0.0-3.7.ep5.el4
0:1.0.0-3.7.ep5.el4
redhat/jboss-ejb3-interceptors<0:1.0.9-0.1.ep5.el4
0:1.0.9-0.1.ep5.el4
redhat/jboss-ejb3-metadata<0:1.0.0-3.ep5.el4
0:1.0.0-3.ep5.el4
redhat/jboss-ejb3-metrics-deployer<0:1.1.1-0.1.ep5.el4
0:1.1.1-0.1.ep5.el4
redhat/jboss-ejb3-security<0:1.0.2-0.5.ep5.el4
0:1.0.2-0.5.ep5.el4
redhat/jboss-ejb3-timeout<0:0.1.1-0.5.ep5.el4
0:0.1.1-0.5.ep5.el4
redhat/jboss-ejb3-transactions<0:1.0.2-1.4.ep5.el4
0:1.0.2-1.4.ep5.el4
redhat/jboss-javaee<0:5.0.2-2.ep5.el4
0:5.0.2-2.ep5.el4
redhat/jboss-jpa-deployers<0:1.0.0-6.SP2.ep5.el4
0:1.0.0-6.SP2.ep5.el4
redhat/jboss-logmanager<0:1.1.2-6.GA_patch_01.ep5.el4
0:1.1.2-6.GA_patch_01.ep5.el4
redhat/jboss-messaging<0:1.4.8-12.SP9.1.ep5.el4
0:1.4.8-12.SP9.1.ep5.el4
redhat/jboss-naming<0:5.0.3-5.CP02.ep5.el4
0:5.0.3-5.CP02.ep5.el4
redhat/jboss-reflect<0:2.0.4-2.1.ep5.el4
0:2.0.4-2.1.ep5.el4
redhat/jboss-remoting<0:2.5.4-10.SP4.1.ep5.el4
0:2.5.4-10.SP4.1.ep5.el4
redhat/jboss-seam2<0:2.2.6.EAP5-9.ep5.el4
0:2.2.6.EAP5-9.ep5.el4
redhat/jboss-security-negotiation<0:2.1.3-1.GA.ep5.el4
0:2.1.3-1.GA.ep5.el4
redhat/jboss-security-spi<1:2.0.5-4.SP3_1.ep5.el4
1:2.0.5-4.SP3_1.ep5.el4
redhat/jbosssx2<0:2.0.5-8.3.SP3_1.ep5.el4
0:2.0.5-8.3.SP3_1.ep5.el4
redhat/jbossts<1:4.6.1-12.CP13.8.ep5.el4
1:4.6.1-12.CP13.8.ep5.el4
redhat/jboss-vfs2<0:2.2.1-2.GA.ep5.el4
0:2.2.1-2.GA.ep5.el4
redhat/jbossweb<0:2.1.13-2_patch_01.ep5.el4
0:2.1.13-2_patch_01.ep5.el4
redhat/jbossws<0:3.1.2-13.SP15_patch_01.ep5.el4
0:3.1.2-13.SP15_patch_01.ep5.el4
redhat/jbossws-common<0:1.1.0-9.SP10.ep5.el4
0:1.1.0-9.SP10.ep5.el4
redhat/jbossws-framework<0:3.1.2-9.SP13.ep5.el4
0:3.1.2-9.SP13.ep5.el4
redhat/jbossws-spi<0:1.1.2-6.SP8.ep5.el4
0:1.1.2-6.SP8.ep5.el4
redhat/jgroups<1:2.6.22-1.ep5.el4
1:2.6.22-1.ep5.el4
redhat/jopr-embedded<0:1.3.4-19.SP6.9.ep5.el4
0:1.3.4-19.SP6.9.ep5.el4
redhat/jopr-hibernate-plugin<0:3.0.0-14.EmbJopr5.ep5.el4
0:3.0.0-14.EmbJopr5.ep5.el4
redhat/jopr-jboss-as<5-plugin-0:3.0.0-15.EmbJopr5.ep5.el4
5-plugin-0:3.0.0-15.EmbJopr5.ep5.el4
redhat/jopr-jboss-cache-v3-plugin<0:3.0.0-15.EmbJopr5.ep5.el4
0:3.0.0-15.EmbJopr5.ep5.el4
redhat/netty<0:3.2.5-6.ep5.el4
0:3.2.5-6.ep5.el4
redhat/picketlink-federation<0:2.1.5-3.ep5.el4
0:2.1.5-3.ep5.el4
redhat/picketlink-quickstarts<0:2.1.5-1.ep5.el4
0:2.1.5-1.ep5.el4
redhat/resteasy<0:1.2.1-18.CP02_patch02.1.ep5.el4
0:1.2.1-18.CP02_patch02.1.ep5.el4
redhat/rh-eap-docs<0:5.2.0-7.ep5.el4
0:5.2.0-7.ep5.el4
redhat/rhq<0:3.0.0-22.EmbJopr5.ep5.el4
0:3.0.0-22.EmbJopr5.ep5.el4
redhat/rhq-jmx-plugin<0:3.0.0-21.EmbJopr5.ep5.el4
0:3.0.0-21.EmbJopr5.ep5.el4
redhat/rhq-platform-plugin<0:3.0.0-15.EmbJopr5.ep5.el4
0:3.0.0-15.EmbJopr5.ep5.el4
redhat/spring2<0:2.5.6-9.SEC03.1.ep5.el4
0:2.5.6-9.SEC03.1.ep5.el4
redhat/wss4j<0:1.5.12-4.2_patch_02.ep5.el4
0:1.5.12-4.2_patch_02.ep5.el4
redhat/xerces-j2<0:2.9.1-10.patch02.ep5.el4
0:2.9.1-10.patch02.ep5.el4
redhat/xml-commons<1:1.3.04-8.2_patch_01.ep5.el4
1:1.3.04-8.2_patch_01.ep5.el4
redhat/xml-security<0:1.5.1-2.ep5.el4
0:1.5.1-2.ep5.el4
redhat/hornetq<0:2.2.24-1.EAP.GA.ep5.el5
0:2.2.24-1.EAP.GA.ep5.el5
redhat/hornetq-native<0:2.2.20-1.EAP.GA.1.ep5.el5
0:2.2.20-1.EAP.GA.1.ep5.el5
redhat/jbossas<0:5.2.0-14.ep5.el5
0:5.2.0-14.ep5.el5
redhat/jbossas-hornetq<0:5.2.0-5.ep5.el5
0:5.2.0-5.ep5.el5
redhat/jbossas-tp-licenses<0:5.2.0-7.ep5.el5
0:5.2.0-7.ep5.el5
redhat/jbossas-ws-cxf<0:5.2.0-7.ep5.el5
0:5.2.0-7.ep5.el5
redhat/jboss-messaging<0:1.4.8-12.SP9.1.ep5.el5
0:1.4.8-12.SP9.1.ep5.el5
redhat/netty<0:3.2.5-6.ep5.el5
0:3.2.5-6.ep5.el5
redhat/rh-eap-docs<0:5.2.0-6.ep5.el5
0:5.2.0-6.ep5.el5
redhat/hornetq<0:2.2.24-1.EAP.GA.ep5.el6
0:2.2.24-1.EAP.GA.ep5.el6
redhat/hornetq-native<0:2.2.20-1.EAP.GA.ep5.el6
0:2.2.20-1.EAP.GA.ep5.el6
redhat/jbossas<0:5.2.0-16.ep5.el6
0:5.2.0-16.ep5.el6
redhat/jbossas-hornetq<0:5.2.0-7.ep5.el6
0:5.2.0-7.ep5.el6
redhat/jbossas-tp-licenses<0:5.2.0-8.ep5.el6
0:5.2.0-8.ep5.el6
redhat/jbossas-ws-cxf<0:5.2.0-10.ep5.el6
0:5.2.0-10.ep5.el6
redhat/jboss-messaging<0:1.4.8-12.SP9.1.ep5.el6
0:1.4.8-12.SP9.1.ep5.el6
redhat/netty<0:3.2.5-6.ep5.el6
0:3.2.5-6.ep5.el6
redhat/rh-eap-docs<0:5.2.0-10.ep5.el6
0:5.2.0-10.ep5.el6
Apache CXF>=2.4.0<=2.4.6
Apache CXF>=2.5.0<=2.5.2
Apache WSS4J<1.6.5
redhat Jboss Business Rules Management System=5.3
redhat JBoss Enterprise Application Platform=5.0.0
redhat Jboss Enterprise Application Platform Text-only Advisories
redhat Jboss Enterprise Soa Platform=4.2.0
redhat Jboss Enterprise Soa Platform=4.3.0
redhat Jboss Enterprise Web Platform=5.0.0
redhat Jboss Middleware Text-only Advisories
redhat Jboss Portal=4.0.0
redhat Jboss Web Services

Remediation

Patch Available

http://rhn.redhat.com/errata/RHSA-2013-0191.html

Patch Available

http://rhn.redhat.com/errata/RHSA-2013-0192.html

Patch Available

http://rhn.redhat.com/errata/RHSA-2013-0193.html

Patch Available

http://rhn.redhat.com/errata/RHSA-2013-0194.html

Patch Available

http://rhn.redhat.com/errata/RHSA-2013-0195.html

Patch Available

http://rhn.redhat.com/errata/RHSA-2013-0196.html

Patch Available

http://rhn.redhat.com/errata/RHSA-2013-0198.html

Patch Available

http://rhn.redhat.com/errata/RHSA-2013-0221.html

Patch Available

https://bugzilla.redhat.com/show_bug.cgi?id=713539

Event History

Jun 15, 2011
Data Sourced
05:47 PM
DescriptionSeverityAffected Software
Sep 4, 2012
CVE Published
12:00 AM
Mar 11, 2020
CVE Published
via MITRE·03:45 PM
Data Sourced
via MITRE·03:45 PM
DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2011-2487?

CVE-2011-2487 has a severity rating of high due to the potential for chosen-ciphertext attacks that lead to compromised symmetric keys.

2

How do I fix CVE-2011-2487?

To fix CVE-2011-2487, update your JBoss packages to the recommended versions listed in the vulnerability advisory.

3

What software is affected by CVE-2011-2487?

CVE-2011-2487 affects multiple JBoss packages, including JBoss Web Services and associated libraries such as aopalliance and apache-cxf.

4

Can CVE-2011-2487 be exploited remotely?

Yes, CVE-2011-2487 can be exploited remotely by attackers to execute chosen-ciphertext attacks against the affected JBoss web services.

5

What types of attacks can exploit CVE-2011-2487?

CVE-2011-2487 can be exploited for chosen-ciphertext attacks, allowing attackers to retrieve sensitive data by compromising symmetric keys.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203