CVE-2011-2487
First published: Wed Jun 15 2011(Updated: )
A flaw was found in JBoss web services where the services used a weak symmetric encryption protocol, PKCS#1 v1.5. An attacker could use this weakness in chosen-ciphertext attacks to recover the symmetric key and conduct further attacks.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/aopalliance | <0:1.0-5.2.jdk6.ep5.el5 | 0:1.0-5.2.jdk6.ep5.el5 |
| redhat/apache-cxf | <0:2.2.12-6.1.patch_04.ep5.el5 | 0:2.2.12-6.1.patch_04.ep5.el5 |
| redhat/bsh2 | <0:2.0-0.b4.15.1.patch01.ep5.el5 | 0:2.0-0.b4.15.1.patch01.ep5.el5 |
| redhat/glassfish-jaxb | <0:2.1.12-12_patch_03.ep5.el5 | 0:2.1.12-12_patch_03.ep5.el5 |
| redhat/google-guice | <0:2.0-3.ep5.el5 | 0:2.0-3.ep5.el5 |
| redhat/hibernate3 | <1:3.3.2-1.5.GA_CP05.ep5.el5 | 1:3.3.2-1.5.GA_CP05.ep5.el5 |
| redhat/hibernate3-annotations | <0:3.4.0-3.3.GA_CP05.ep5.el5 | 0:3.4.0-3.3.GA_CP05.ep5.el5 |
| redhat/hibernate3-entitymanager | <0:3.4.0-4.4.GA_CP05.ep5.el5 | 0:3.4.0-4.4.GA_CP05.ep5.el5 |
| redhat/hibernate3-search | <0:3.1.1-2.4.GA_CP05.ep5.el5 | 0:3.1.1-2.4.GA_CP05.ep5.el5 |
| redhat/jacorb-jboss | <0:2.3.2-2.jboss_1.ep5.el5 | 0:2.3.2-2.jboss_1.ep5.el5 |
| redhat/javassist | <0:3.12.0-6.SP1.ep5.el5 | 0:3.12.0-6.SP1.ep5.el5 |
| redhat/jboss-aop2 | <0:2.1.6-5.CP06.ep5.el5 | 0:2.1.6-5.CP06.ep5.el5 |
| redhat/jbossas-web | <0:5.2.0-8.ep5.el5 | 0:5.2.0-8.ep5.el5 |
| redhat/jbossas-web-tp-licenses | <0:5.2.0-7.ep5.el5 | 0:5.2.0-7.ep5.el5 |
| redhat/jbossas-ws-cxf-ewp | <0:5.2.0-7.ep5.el5 | 0:5.2.0-7.ep5.el5 |
| redhat/jboss-bootstrap | <0:1.0.2-1.ep5.el5 | 0:1.0.2-1.ep5.el5 |
| redhat/jboss-cache-core | <0:3.2.11-1.GA.ep5.el5 | 0:3.2.11-1.GA.ep5.el5 |
| redhat/jboss-cache-pojo | <0:3.0.1-1.1.ep5.el5 | 0:3.0.1-1.1.ep5.el5 |
| redhat/jboss-cl | <0:2.0.11-1.GA.ep5.el5 | 0:2.0.11-1.GA.ep5.el5 |
| redhat/jboss-cluster-ha-server-api | <0:1.2.1-2.ep5.el5 | 0:1.2.1-2.ep5.el5 |
| redhat/jboss-common-beans | <0:1.0.1-2.1.Final.ep5.el5 | 0:1.0.1-2.1.Final.ep5.el5 |
| redhat/jboss-common-core | <0:2.2.21-1.ep5.el5 | 0:2.2.21-1.ep5.el5 |
| redhat/jboss-eap5-native | <0:5.2.0-6.ep5.el5 | 0:5.2.0-6.ep5.el5 |
| redhat/jboss-ejb3-cache | <0:1.0.0-4.ep5.el5 | 0:1.0.0-4.ep5.el5 |
| redhat/jboss-ejb3-core | <0:1.3.9-0.4.ep5.el5 | 0:1.3.9-0.4.ep5.el5 |
| redhat/jboss-ejb3-ext-api | <0:1.0.0-4.1.ep5.el5 | 0:1.0.0-4.1.ep5.el5 |
| redhat/jboss-ejb3-ext-api-impl | <0:1.0.0-3.7.ep5.el5 | 0:1.0.0-3.7.ep5.el5 |
| redhat/jboss-ejb3-interceptors | <0:1.0.9-0.1.ep5.el5 | 0:1.0.9-0.1.ep5.el5 |
| redhat/jboss-ejb3-metadata | <0:1.0.0-3.ep5.el5 | 0:1.0.0-3.ep5.el5 |
| redhat/jboss-ejb3-metrics-deployer | <0:1.1.1-0.1.ep5.el5 | 0:1.1.1-0.1.ep5.el5 |
| redhat/jboss-ejb3-security | <0:1.0.2-0.5.ep5.el5 | 0:1.0.2-0.5.ep5.el5 |
| redhat/jboss-ejb3-timeout | <0:0.1.1-0.5.ep5.el5 | 0:0.1.1-0.5.ep5.el5 |
| redhat/jboss-ejb3-transactions | <0:1.0.2-1.4.ep5.el5 | 0:1.0.2-1.4.ep5.el5 |
| redhat/jboss-javaee | <0:5.0.2-2.ep5.el5 | 0:5.0.2-2.ep5.el5 |
| redhat/jboss-jpa-deployers | <0:1.0.0-6.1SP2.ep5.el5 | 0:1.0.0-6.1SP2.ep5.el5 |
| redhat/jboss-logmanager | <0:1.1.2-6.GA_patch_01.ep5.el5 | 0:1.1.2-6.GA_patch_01.ep5.el5 |
| redhat/jboss-naming | <0:5.0.3-5.1.CP02.ep5.el5 | 0:5.0.3-5.1.CP02.ep5.el5 |
| redhat/jboss-reflect | <0:2.0.4-2.1.ep5.el5 | 0:2.0.4-2.1.ep5.el5 |
| redhat/jboss-remoting | <0:2.5.4-10.SP4.1.ep5.el5 | 0:2.5.4-10.SP4.1.ep5.el5 |
| redhat/jboss-seam2 | <0:2.2.6.EAP5-10.ep5.el5 | 0:2.2.6.EAP5-10.ep5.el5 |
| redhat/jboss-security-negotiation | <0:2.1.3-1.GA.ep5.el5 | 0:2.1.3-1.GA.ep5.el5 |
| redhat/jboss-security-spi | <1:2.0.5-4.SP3_1.ep5.el5 | 1:2.0.5-4.SP3_1.ep5.el5 |
| redhat/jbosssx2 | <0:2.0.5-8.SP3_1.ep5.el5 | 0:2.0.5-8.SP3_1.ep5.el5 |
| redhat/jbossts | <1:4.6.1-12.CP13.8.ep5.el5 | 1:4.6.1-12.CP13.8.ep5.el5 |
| redhat/jboss-vfs2 | <0:2.2.1-4.GA.ep5.el5 | 0:2.2.1-4.GA.ep5.el5 |
| redhat/jbossweb | <0:2.1.13-2_patch_01.ep5.el5 | 0:2.1.13-2_patch_01.ep5.el5 |
| redhat/jbossws | <0:3.1.2-13.SP15_patch_01.ep5.el5 | 0:3.1.2-13.SP15_patch_01.ep5.el5 |
| redhat/jbossws-common | <0:1.1.0-9.SP10.ep5.el5 | 0:1.1.0-9.SP10.ep5.el5 |
| redhat/jbossws-framework | <0:3.1.2-9.SP13.ep5.el5 | 0:3.1.2-9.SP13.ep5.el5 |
| redhat/jbossws-spi | <0:1.1.2-6.SP8.ep5.el5 | 0:1.1.2-6.SP8.ep5.el5 |
| redhat/jgroups | <1:2.6.22-1.ep5.el5 | 1:2.6.22-1.ep5.el5 |
| redhat/jopr-embedded | <0:1.3.4-19.SP6.9.ep5.el5 | 0:1.3.4-19.SP6.9.ep5.el5 |
| redhat/jopr-hibernate-plugin | <0:3.0.0-14.EmbJopr5.ep5.el5 | 0:3.0.0-14.EmbJopr5.ep5.el5 |
| redhat/jopr-jboss-as | <5-plugin-0:3.0.0-14.EmbJopr5.ep5.el5 | 5-plugin-0:3.0.0-14.EmbJopr5.ep5.el5 |
| redhat/jopr-jboss-cache-v3-plugin | <0:3.0.0-15.EmbJopr5.ep5.el5 | 0:3.0.0-15.EmbJopr5.ep5.el5 |
| redhat/picketlink-federation | <0:2.1.5-3.ep5.el5 | 0:2.1.5-3.ep5.el5 |
| redhat/picketlink-quickstarts | <0:2.1.5-1.ep5.el5 | 0:2.1.5-1.ep5.el5 |
| redhat/resteasy | <0:1.2.1-18.CP02_patch02.1.ep5.el5 | 0:1.2.1-18.CP02_patch02.1.ep5.el5 |
| redhat/rh-ewp-docs | <0:5.2.0-6.ep5.el5 | 0:5.2.0-6.ep5.el5 |
| redhat/rhq | <0:3.0.0-21.EmbJopr5.ep5.el5 | 0:3.0.0-21.EmbJopr5.ep5.el5 |
| redhat/rhq-jmx-plugin | <0:3.0.0-21.EmbJopr5.ep5.el5 | 0:3.0.0-21.EmbJopr5.ep5.el5 |
| redhat/rhq-platform-plugin | <0:3.0.0-14.EmbJopr5.ep5.el5 | 0:3.0.0-14.EmbJopr5.ep5.el5 |
| redhat/spring2 | <0:2.5.6-9.SEC03.1.ep5.el5 | 0:2.5.6-9.SEC03.1.ep5.el5 |
| redhat/wss4j | <0:1.5.12-4.1_patch_02.ep5.el5 | 0:1.5.12-4.1_patch_02.ep5.el5 |
| redhat/xerces-j2 | <0:2.9.1-10.patch02.ep5.el5 | 0:2.9.1-10.patch02.ep5.el5 |
| redhat/xml-commons | <0:1.3.04-8.2_patch_01.ep5.el5 | 0:1.3.04-8.2_patch_01.ep5.el5 |
| redhat/xml-security | <0:1.5.1-2.ep5.el5 | 0:1.5.1-2.ep5.el5 |
| redhat/aopalliance | <0:1.0-5.3.ep5.el6 | 0:1.0-5.3.ep5.el6 |
| redhat/apache-cxf | <0:2.2.12-6.1.patch_04.ep5.el6 | 0:2.2.12-6.1.patch_04.ep5.el6 |
| redhat/bsh2 | <0:2.0-0.b4.15.patch01.ep5.el6 | 0:2.0-0.b4.15.patch01.ep5.el6 |
| redhat/glassfish-jaxb | <0:2.1.12-12_patch_03.ep5.el6 | 0:2.1.12-12_patch_03.ep5.el6 |
| redhat/google-guice | <0:2.0-3.ep5.el6 | 0:2.0-3.ep5.el6 |
| redhat/hibernate3 | <1:3.3.2-1.9.GA_CP05.ep5.el6 | 1:3.3.2-1.9.GA_CP05.ep5.el6 |
| redhat/hibernate3-annotations | <0:3.4.0-3.6.GA_CP05.ep5.el6 | 0:3.4.0-3.6.GA_CP05.ep5.el6 |
| redhat/hibernate3-entitymanager | <0:3.4.0-4.5.GA_CP05.ep5.el6 | 0:3.4.0-4.5.GA_CP05.ep5.el6 |
| redhat/hibernate3-search | <0:3.1.1-2.5.GA_CP05.ep5.el6 | 0:3.1.1-2.5.GA_CP05.ep5.el6 |
| redhat/hsqldb | <2:1.8.0.10-11_patch_01.1.ep5.el6 | 2:1.8.0.10-11_patch_01.1.ep5.el6 |
| redhat/jacorb-jboss | <0:2.3.2-2.jboss_1.ep5.el6 | 0:2.3.2-2.jboss_1.ep5.el6 |
| redhat/javassist | <0:3.12.0-6.SP1.ep5.el6 | 0:3.12.0-6.SP1.ep5.el6 |
| redhat/jboss-aop2 | <0:2.1.6-5.CP06.ep5.el6 | 0:2.1.6-5.CP06.ep5.el6 |
| redhat/jbossas-web | <0:5.2.0-16.ep5.el6 | 0:5.2.0-16.ep5.el6 |
| redhat/jbossas-web-tp-licenses | <0:5.2.0-8.ep5.el6 | 0:5.2.0-8.ep5.el6 |
| redhat/jbossas-ws-cxf-ewp | <0:5.2.0-11.ep5.el6 | 0:5.2.0-11.ep5.el6 |
| redhat/jboss-bootstrap | <0:1.0.2-1.ep5.el6 | 0:1.0.2-1.ep5.el6 |
| redhat/jboss-cache-core | <0:3.2.11-1.GA.ep5.el6 | 0:3.2.11-1.GA.ep5.el6 |
| redhat/jboss-cache-pojo | <0:3.0.1-1.ep5.el6 | 0:3.0.1-1.ep5.el6 |
| redhat/jboss-cl | <0:2.0.11-4.GA.ep5.el6 | 0:2.0.11-4.GA.ep5.el6 |
| redhat/jboss-cluster-ha-server-api | <0:1.2.1-2.ep5.el6 | 0:1.2.1-2.ep5.el6 |
| redhat/jboss-common-beans | <0:1.0.1-2.Final.ep5.el6 | 0:1.0.1-2.Final.ep5.el6 |
| redhat/jboss-common-core | <0:2.2.21-1.ep5.el6 | 0:2.2.21-1.ep5.el6 |
| redhat/jboss-eap5-native | <0:5.2.0-6.ep5.el6 | 0:5.2.0-6.ep5.el6 |
| redhat/jboss-ejb3-cache | <0:1.0.0-4.ep5.el6 | 0:1.0.0-4.ep5.el6 |
| redhat/jboss-ejb3-core | <0:1.3.9-0.4.ep5.el6 | 0:1.3.9-0.4.ep5.el6 |
| redhat/jboss-ejb3-ext-api | <0:1.0.0-4.1.ep5.el6 | 0:1.0.0-4.1.ep5.el6 |
| redhat/jboss-ejb3-ext-api-impl | <0:1.0.0-3.7.ep5.el6 | 0:1.0.0-3.7.ep5.el6 |
| redhat/jboss-ejb3-interceptors | <0:1.0.9-0.2.ep5.el6 | 0:1.0.9-0.2.ep5.el6 |
| redhat/jboss-ejb3-metadata | <0:1.0.0-3.ep5.el6 | 0:1.0.0-3.ep5.el6 |
| redhat/jboss-ejb3-metrics-deployer | <0:1.1.1-0.1.ep5.el6 | 0:1.1.1-0.1.ep5.el6 |
| redhat/jboss-ejb3-security | <0:1.0.2-0.5.ep5.el6 | 0:1.0.2-0.5.ep5.el6 |
| redhat/jboss-ejb3-timeout | <0:0.1.1-0.8.ep5.el6 | 0:0.1.1-0.8.ep5.el6 |
| redhat/jboss-ejb3-transactions | <0:1.0.2-1.6.ep5.el6 | 0:1.0.2-1.6.ep5.el6 |
| redhat/jboss-javaee | <0:5.0.2-2.ep5.el6 | 0:5.0.2-2.ep5.el6 |
| redhat/jboss-jpa-deployers | <0:1.0.0-6.SP2.ep5.el6 | 0:1.0.0-6.SP2.ep5.el6 |
| redhat/jboss-logmanager | <0:1.1.2-6.GA_patch_01.ep5.el6 | 0:1.1.2-6.GA_patch_01.ep5.el6 |
| redhat/jboss-naming | <0:5.0.3-5.CP02.ep5.el6 | 0:5.0.3-5.CP02.ep5.el6 |
| redhat/jboss-reflect | <0:2.0.4-2.ep5.el6 | 0:2.0.4-2.ep5.el6 |
| redhat/jboss-remoting | <0:2.5.4-10.SP4.1.ep5.el6 | 0:2.5.4-10.SP4.1.ep5.el6 |
| redhat/jboss-seam2 | <0:2.2.6.EAP5-14.ep5.el6 | 0:2.2.6.EAP5-14.ep5.el6 |
| redhat/jboss-security-negotiation | <0:2.1.3-1.GA.ep5.el6 | 0:2.1.3-1.GA.ep5.el6 |
| redhat/jboss-security-spi | <1:2.0.5-4.SP3_1.ep5.el6 | 1:2.0.5-4.SP3_1.ep5.el6 |
| redhat/jbosssx2 | <0:2.0.5-8.3.SP3_1.ep5.el6 | 0:2.0.5-8.3.SP3_1.ep5.el6 |
| redhat/jbossts | <1:4.6.1-12.CP13.7.ep5.el6 | 1:4.6.1-12.CP13.7.ep5.el6 |
| redhat/jboss-vfs2 | <0:2.2.1-4.GA.ep5.el6 | 0:2.2.1-4.GA.ep5.el6 |
| redhat/jbossweb | <0:2.1.13-2_patch_01.ep5.el6 | 0:2.1.13-2_patch_01.ep5.el6 |
| redhat/jbossws | <0:3.1.2-13.SP15_patch_01.ep5.el6 | 0:3.1.2-13.SP15_patch_01.ep5.el6 |
| redhat/jbossws-common | <0:1.1.0-9.SP10.ep5.el6 | 0:1.1.0-9.SP10.ep5.el6 |
| redhat/jbossws-framework | <0:3.1.2-9.SP13.ep5.el6 | 0:3.1.2-9.SP13.ep5.el6 |
| redhat/jbossws-spi | <0:1.1.2-6.SP8.ep5.el6 | 0:1.1.2-6.SP8.ep5.el6 |
| redhat/jgroups | <1:2.6.22-1.ep5.el6 | 1:2.6.22-1.ep5.el6 |
| redhat/jopr-embedded | <0:1.3.4-19.SP6.9.ep5.el6 | 0:1.3.4-19.SP6.9.ep5.el6 |
| redhat/jopr-hibernate-plugin | <0:3.0.0-14.EmbJopr5.ep5.el6 | 0:3.0.0-14.EmbJopr5.ep5.el6 |
| redhat/jopr-jboss-as | <5-plugin-0:3.0.0-16.EmbJopr5.ep5.el6 | 5-plugin-0:3.0.0-16.EmbJopr5.ep5.el6 |
| redhat/jopr-jboss-cache-v3-plugin | <0:3.0.0-15.EmbJopr5.ep5.el6 | 0:3.0.0-15.EmbJopr5.ep5.el6 |
| redhat/picketlink-federation | <0:2.1.5-3.ep5.el6 | 0:2.1.5-3.ep5.el6 |
| redhat/picketlink-quickstarts | <0:2.1.5-1.ep5.el6 | 0:2.1.5-1.ep5.el6 |
| redhat/resteasy | <0:1.2.1-17.CP02_patch02.1.ep5.el6 | 0:1.2.1-17.CP02_patch02.1.ep5.el6 |
| redhat/rh-ewp-docs | <0:5.2.0-11.ep5.el6 | 0:5.2.0-11.ep5.el6 |
| redhat/rhq | <0:3.0.0-21.EmbJopr5.ep5.el6 | 0:3.0.0-21.EmbJopr5.ep5.el6 |
| redhat/rhq-jmx-plugin | <0:3.0.0-21.EmbJopr5.ep5.el6 | 0:3.0.0-21.EmbJopr5.ep5.el6 |
| redhat/rhq-platform-plugin | <0:3.0.0-14.EmbJopr5.ep5.el6 | 0:3.0.0-14.EmbJopr5.ep5.el6 |
| redhat/spring2 | <0:2.5.6-9.SEC03.1.ep5.el6 | 0:2.5.6-9.SEC03.1.ep5.el6 |
| redhat/wss4j | <0:1.5.12-4_patch_02.ep5.el6 | 0:1.5.12-4_patch_02.ep5.el6 |
| redhat/xerces-j2 | <0:2.9.1-10.patch02.ep5.el6 | 0:2.9.1-10.patch02.ep5.el6 |
| redhat/xml-commons | <0:1.3.04-8.2_patch_01.ep5.el6 | 0:1.3.04-8.2_patch_01.ep5.el6 |
| redhat/xml-security | <0:1.5.1-2.ep5.el6 | 0:1.5.1-2.ep5.el6 |
| redhat/aopalliance | <0:1.0-5.2.jdk6.ep5.el4 | 0:1.0-5.2.jdk6.ep5.el4 |
| redhat/apache-cxf | <0:2.2.12-6.1.patch_04.ep5.el4 | 0:2.2.12-6.1.patch_04.ep5.el4 |
| redhat/bsh2 | <0:2.0-0.b4.15.1.patch01.ep5.el4 | 0:2.0-0.b4.15.1.patch01.ep5.el4 |
| redhat/glassfish-jaxb | <0:2.1.12-12_patch_03.ep5.el4 | 0:2.1.12-12_patch_03.ep5.el4 |
| redhat/google-guice | <0:2.0-3.ep5.el4 | 0:2.0-3.ep5.el4 |
| redhat/hibernate3 | <1:3.3.2-1.6.GA_CP05.ep5.el4 | 1:3.3.2-1.6.GA_CP05.ep5.el4 |
| redhat/hibernate3-annotations | <0:3.4.0-3.4.GA_CP05.ep5.el4 | 0:3.4.0-3.4.GA_CP05.ep5.el4 |
| redhat/hibernate3-entitymanager | <0:3.4.0-4.4.GA_CP05.ep5.el4 | 0:3.4.0-4.4.GA_CP05.ep5.el4 |
| redhat/hibernate3-search | <0:3.1.1-2.3.GA_CP05.ep5.el4 | 0:3.1.1-2.3.GA_CP05.ep5.el4 |
| redhat/hornetq | <0:2.2.24-1.EAP.GA.ep5.el4 | 0:2.2.24-1.EAP.GA.ep5.el4 |
| redhat/hornetq-native | <0:2.2.20-1.EAP.GA.1.ep5.el4 | 0:2.2.20-1.EAP.GA.1.ep5.el4 |
| redhat/jacorb-jboss | <0:2.3.2-2.jboss_1.ep5.el4 | 0:2.3.2-2.jboss_1.ep5.el4 |
| redhat/javassist | <0:3.12.0-6.SP1.ep5.el4 | 0:3.12.0-6.SP1.ep5.el4 |
| redhat/jboss-aop2 | <0:2.1.6-5.CP06.ep5.el4 | 0:2.1.6-5.CP06.ep5.el4 |
| redhat/jbossas | <0:5.2.0-14.ep5.el4 | 0:5.2.0-14.ep5.el4 |
| redhat/jbossas-hornetq | <0:5.2.0-6.ep5.el4 | 0:5.2.0-6.ep5.el4 |
| redhat/jbossas-tp-licenses | <0:5.2.0-7.ep5.el4 | 0:5.2.0-7.ep5.el4 |
| redhat/jbossas-ws-cxf | <0:5.2.0-8.ep5.el4 | 0:5.2.0-8.ep5.el4 |
| redhat/jboss-bootstrap | <0:1.0.2-1.ep5.el4 | 0:1.0.2-1.ep5.el4 |
| redhat/jboss-cache-core | <0:3.2.11-1.GA.ep5.el4 | 0:3.2.11-1.GA.ep5.el4 |
| redhat/jboss-cache-pojo | <0:3.0.1-1.1.ep5.el4 | 0:3.0.1-1.1.ep5.el4 |
| redhat/jboss-cl | <0:2.0.11-1.GA.ep5.el4 | 0:2.0.11-1.GA.ep5.el4 |
| redhat/jboss-cluster-ha-server-api | <0:1.2.1-2.ep5.el4 | 0:1.2.1-2.ep5.el4 |
| redhat/jboss-common-beans | <0:1.0.1-2.1.Final.ep5.el4 | 0:1.0.1-2.1.Final.ep5.el4 |
| redhat/jboss-common-core | <0:2.2.21-1.ep5.el4 | 0:2.2.21-1.ep5.el4 |
| redhat/jboss-eap5-native | <0:5.2.0-6.ep5.el4 | 0:5.2.0-6.ep5.el4 |
| redhat/jboss-ejb3-cache | <0:1.0.0-4.ep5.el4 | 0:1.0.0-4.ep5.el4 |
| redhat/jboss-ejb3-core | <0:1.3.9-0.4.ep5.el4 | 0:1.3.9-0.4.ep5.el4 |
| redhat/jboss-ejb3-ext-api | <0:1.0.0-4.1.ep5.el4 | 0:1.0.0-4.1.ep5.el4 |
| redhat/jboss-ejb3-ext-api-impl | <0:1.0.0-3.7.ep5.el4 | 0:1.0.0-3.7.ep5.el4 |
| redhat/jboss-ejb3-interceptors | <0:1.0.9-0.1.ep5.el4 | 0:1.0.9-0.1.ep5.el4 |
| redhat/jboss-ejb3-metadata | <0:1.0.0-3.ep5.el4 | 0:1.0.0-3.ep5.el4 |
| redhat/jboss-ejb3-metrics-deployer | <0:1.1.1-0.1.ep5.el4 | 0:1.1.1-0.1.ep5.el4 |
| redhat/jboss-ejb3-security | <0:1.0.2-0.5.ep5.el4 | 0:1.0.2-0.5.ep5.el4 |
| redhat/jboss-ejb3-timeout | <0:0.1.1-0.5.ep5.el4 | 0:0.1.1-0.5.ep5.el4 |
| redhat/jboss-ejb3-transactions | <0:1.0.2-1.4.ep5.el4 | 0:1.0.2-1.4.ep5.el4 |
| redhat/jboss-javaee | <0:5.0.2-2.ep5.el4 | 0:5.0.2-2.ep5.el4 |
| redhat/jboss-jpa-deployers | <0:1.0.0-6.SP2.ep5.el4 | 0:1.0.0-6.SP2.ep5.el4 |
| redhat/jboss-logmanager | <0:1.1.2-6.GA_patch_01.ep5.el4 | 0:1.1.2-6.GA_patch_01.ep5.el4 |
| redhat/jboss-messaging | <0:1.4.8-12.SP9.1.ep5.el4 | 0:1.4.8-12.SP9.1.ep5.el4 |
| redhat/jboss-naming | <0:5.0.3-5.CP02.ep5.el4 | 0:5.0.3-5.CP02.ep5.el4 |
| redhat/jboss-reflect | <0:2.0.4-2.1.ep5.el4 | 0:2.0.4-2.1.ep5.el4 |
| redhat/jboss-remoting | <0:2.5.4-10.SP4.1.ep5.el4 | 0:2.5.4-10.SP4.1.ep5.el4 |
| redhat/jboss-seam2 | <0:2.2.6.EAP5-9.ep5.el4 | 0:2.2.6.EAP5-9.ep5.el4 |
| redhat/jboss-security-negotiation | <0:2.1.3-1.GA.ep5.el4 | 0:2.1.3-1.GA.ep5.el4 |
| redhat/jboss-security-spi | <1:2.0.5-4.SP3_1.ep5.el4 | 1:2.0.5-4.SP3_1.ep5.el4 |
| redhat/jbosssx2 | <0:2.0.5-8.3.SP3_1.ep5.el4 | 0:2.0.5-8.3.SP3_1.ep5.el4 |
| redhat/jbossts | <1:4.6.1-12.CP13.8.ep5.el4 | 1:4.6.1-12.CP13.8.ep5.el4 |
| redhat/jboss-vfs2 | <0:2.2.1-2.GA.ep5.el4 | 0:2.2.1-2.GA.ep5.el4 |
| redhat/jbossweb | <0:2.1.13-2_patch_01.ep5.el4 | 0:2.1.13-2_patch_01.ep5.el4 |
| redhat/jbossws | <0:3.1.2-13.SP15_patch_01.ep5.el4 | 0:3.1.2-13.SP15_patch_01.ep5.el4 |
| redhat/jbossws-common | <0:1.1.0-9.SP10.ep5.el4 | 0:1.1.0-9.SP10.ep5.el4 |
| redhat/jbossws-framework | <0:3.1.2-9.SP13.ep5.el4 | 0:3.1.2-9.SP13.ep5.el4 |
| redhat/jbossws-spi | <0:1.1.2-6.SP8.ep5.el4 | 0:1.1.2-6.SP8.ep5.el4 |
| redhat/jgroups | <1:2.6.22-1.ep5.el4 | 1:2.6.22-1.ep5.el4 |
| redhat/jopr-embedded | <0:1.3.4-19.SP6.9.ep5.el4 | 0:1.3.4-19.SP6.9.ep5.el4 |
| redhat/jopr-hibernate-plugin | <0:3.0.0-14.EmbJopr5.ep5.el4 | 0:3.0.0-14.EmbJopr5.ep5.el4 |
| redhat/jopr-jboss-as | <5-plugin-0:3.0.0-15.EmbJopr5.ep5.el4 | 5-plugin-0:3.0.0-15.EmbJopr5.ep5.el4 |
| redhat/jopr-jboss-cache-v3-plugin | <0:3.0.0-15.EmbJopr5.ep5.el4 | 0:3.0.0-15.EmbJopr5.ep5.el4 |
| redhat/netty | <0:3.2.5-6.ep5.el4 | 0:3.2.5-6.ep5.el4 |
| redhat/picketlink-federation | <0:2.1.5-3.ep5.el4 | 0:2.1.5-3.ep5.el4 |
| redhat/picketlink-quickstarts | <0:2.1.5-1.ep5.el4 | 0:2.1.5-1.ep5.el4 |
| redhat/resteasy | <0:1.2.1-18.CP02_patch02.1.ep5.el4 | 0:1.2.1-18.CP02_patch02.1.ep5.el4 |
| redhat/rh-eap-docs | <0:5.2.0-7.ep5.el4 | 0:5.2.0-7.ep5.el4 |
| redhat/rhq | <0:3.0.0-22.EmbJopr5.ep5.el4 | 0:3.0.0-22.EmbJopr5.ep5.el4 |
| redhat/rhq-jmx-plugin | <0:3.0.0-21.EmbJopr5.ep5.el4 | 0:3.0.0-21.EmbJopr5.ep5.el4 |
| redhat/rhq-platform-plugin | <0:3.0.0-15.EmbJopr5.ep5.el4 | 0:3.0.0-15.EmbJopr5.ep5.el4 |
| redhat/spring2 | <0:2.5.6-9.SEC03.1.ep5.el4 | 0:2.5.6-9.SEC03.1.ep5.el4 |
| redhat/wss4j | <0:1.5.12-4.2_patch_02.ep5.el4 | 0:1.5.12-4.2_patch_02.ep5.el4 |
| redhat/xerces-j2 | <0:2.9.1-10.patch02.ep5.el4 | 0:2.9.1-10.patch02.ep5.el4 |
| redhat/xml-commons | <1:1.3.04-8.2_patch_01.ep5.el4 | 1:1.3.04-8.2_patch_01.ep5.el4 |
| redhat/xml-security | <0:1.5.1-2.ep5.el4 | 0:1.5.1-2.ep5.el4 |
| redhat/hornetq | <0:2.2.24-1.EAP.GA.ep5.el5 | 0:2.2.24-1.EAP.GA.ep5.el5 |
| redhat/hornetq-native | <0:2.2.20-1.EAP.GA.1.ep5.el5 | 0:2.2.20-1.EAP.GA.1.ep5.el5 |
| redhat/jbossas | <0:5.2.0-14.ep5.el5 | 0:5.2.0-14.ep5.el5 |
| redhat/jbossas-hornetq | <0:5.2.0-5.ep5.el5 | 0:5.2.0-5.ep5.el5 |
| redhat/jbossas-tp-licenses | <0:5.2.0-7.ep5.el5 | 0:5.2.0-7.ep5.el5 |
| redhat/jbossas-ws-cxf | <0:5.2.0-7.ep5.el5 | 0:5.2.0-7.ep5.el5 |
| redhat/jboss-messaging | <0:1.4.8-12.SP9.1.ep5.el5 | 0:1.4.8-12.SP9.1.ep5.el5 |
| redhat/netty | <0:3.2.5-6.ep5.el5 | 0:3.2.5-6.ep5.el5 |
| redhat/rh-eap-docs | <0:5.2.0-6.ep5.el5 | 0:5.2.0-6.ep5.el5 |
| redhat/hornetq | <0:2.2.24-1.EAP.GA.ep5.el6 | 0:2.2.24-1.EAP.GA.ep5.el6 |
| redhat/hornetq-native | <0:2.2.20-1.EAP.GA.ep5.el6 | 0:2.2.20-1.EAP.GA.ep5.el6 |
| redhat/jbossas | <0:5.2.0-16.ep5.el6 | 0:5.2.0-16.ep5.el6 |
| redhat/jbossas-hornetq | <0:5.2.0-7.ep5.el6 | 0:5.2.0-7.ep5.el6 |
| redhat/jbossas-tp-licenses | <0:5.2.0-8.ep5.el6 | 0:5.2.0-8.ep5.el6 |
| redhat/jbossas-ws-cxf | <0:5.2.0-10.ep5.el6 | 0:5.2.0-10.ep5.el6 |
| redhat/jboss-messaging | <0:1.4.8-12.SP9.1.ep5.el6 | 0:1.4.8-12.SP9.1.ep5.el6 |
| redhat/netty | <0:3.2.5-6.ep5.el6 | 0:3.2.5-6.ep5.el6 |
| redhat/rh-eap-docs | <0:5.2.0-10.ep5.el6 | 0:5.2.0-10.ep5.el6 |
| Apache CXF | >=2.4.0<=2.4.6 | |
| Apache CXF | >=2.5.0<=2.5.2 | |
| Apache WSS4J | <1.6.5 | |
| Red Hat JBoss Business Rules Management System | =5.3 | |
| JBoss Enterprise Application Platform | =5.0.0 | |
| Red Hat JBoss Enterprise Application Platform | ||
| Red Hat JBoss Enterprise SOA Platform | =4.2.0 | |
| Red Hat JBoss Enterprise SOA Platform | =4.3.0 | |
| Red Hat JBoss Enterprise Web Platform | =5.0.0 | |
| Red Hat JBoss Middleware | ||
| Red Hat JBoss Portal | =4.0.0 | |
| Red Hat JBoss Web Services |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://rhn.redhat.com/errata/RHSA-2013-0196.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81737
- http://rhn.redhat.com/errata/RHSA-2013-0221.html
- http://rhn.redhat.com/errata/RHSA-2013-0193.html
- http://rhn.redhat.com/errata/RHSA-2013-0198.html
- https://www.nds.ruhr-uni-bochum.de/research/publications/breaking-xml-encryption-pkcs15/
- http://rhn.redhat.com/errata/RHSA-2013-0195.html
- https://bugzilla.redhat.com/show_bug.cgi?id=713539
- http://rhn.redhat.com/errata/RHSA-2013-0192.html
- http://rhn.redhat.com/errata/RHSA-2013-0191.html
- http://cxf.apache.org/note-on-cve-2011-2487.html
- http://www.securityfocus.com/bid/57549
- http://rhn.redhat.com/errata/RHSA-2013-0194.html
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
- https://access.redhat.com/security/cve/CVE-2011-2487
- https://rhn.redhat.com/errata/RHSA-2013-0194.html
- https://rhn.redhat.com/errata/RHSA-2013-0192.html
- https://rhn.redhat.com/errata/RHSA-2013-0191.html
- https://rhn.redhat.com/errata/RHSA-2013-0195.html
- https://rhn.redhat.com/errata/RHSA-2013-0193.html
- https://rhn.redhat.com/errata/RHSA-2013-0197.html
- https://rhn.redhat.com/errata/RHSA-2013-0196.html
- https://rhn.redhat.com/errata/RHSA-2013-0198.html
- https://rhn.redhat.com/errata/RHSA-2013-0221.html
- https://rhn.redhat.com/errata/RHSA-2013-0533.html
- https://rhn.redhat.com/errata/RHSA-2013-0953.html
- https://rhn.redhat.com/errata/RHSA-2013-1757.html
- https://www.cve.org/CVERecord?id=CVE-2011-2487 https://nvd.nist.gov/vuln/detail/CVE-2011-2487 https://www.nds.ruhr-uni-bochum.de/research/publications/breaking-xml-encryption-pkcs15/
- https://access.redhat.com/errata/RHSA-2013:0196
- https://access.redhat.com/errata/RHSA-2013:0195
- https://access.redhat.com/errata/RHSA-2013:0221
- https://access.redhat.com/errata/RHSA-2013:0194
- https://access.redhat.com/errata/RHSA-2013:0193
- https://access.redhat.com/errata/RHSA-2013:0192
- https://access.redhat.com/errata/RHSA-2013:0191
- https://access.redhat.com/errata/RHSA-2013:0953
- https://access.redhat.com/errata/RHSA-2013:0533
- https://access.redhat.com/errata/RHSA-2013:0198
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2011-2487?
CVE-2011-2487 has a severity rating of high due to the potential for chosen-ciphertext attacks that lead to compromised symmetric keys.
How do I fix CVE-2011-2487?
To fix CVE-2011-2487, update your JBoss packages to the recommended versions listed in the vulnerability advisory.
What software is affected by CVE-2011-2487?
CVE-2011-2487 affects multiple JBoss packages, including JBoss Web Services and associated libraries such as aopalliance and apache-cxf.
Can CVE-2011-2487 be exploited remotely?
Yes, CVE-2011-2487 can be exploited remotely by attackers to execute chosen-ciphertext attacks against the affected JBoss web services.
What types of attacks can exploit CVE-2011-2487?
CVE-2011-2487 can be exploited for chosen-ciphertext attacks, allowing attackers to retrieve sensitive data by compromising symmetric keys.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/severity
- agent/author
- agent/remedy
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-2487
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- package-manager/redhat
- vendor/apache
- canonical/apache cxf
- version/apache cxf/2.4.0
- version/apache cxf/2.4.6
- version/apache cxf/2.5.0
- version/apache cxf/2.5.2
- canonical/apache wss4j
- vendor/redhat
- canonical/red hat jboss business rules management system
- version/red hat jboss business rules management system/5.3
- canonical/jboss enterprise application platform
- version/jboss enterprise application platform/5.0.0
- canonical/red hat jboss enterprise application platform
- canonical/red hat jboss enterprise soa platform
- version/red hat jboss enterprise soa platform/4.2.0
- version/red hat jboss enterprise soa platform/4.3.0
- canonical/red hat jboss enterprise web platform
- version/red hat jboss enterprise web platform/5.0.0
- canonical/red hat jboss middleware
- canonical/red hat jboss portal
- version/red hat jboss portal/4.0.0
- canonical/red hat jboss web services