What’s Vulnerable › Vulnerabilities

CVE-2011-2487

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-11 · updated 2026-06-16
• Weakness: CWE-327

Description

The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.

Affected products

• Apache Software Foundation Apache CXF: from 2.4.0 through 2.4.6; from 2.5.0 through 2.5.2
• Apache Software Foundation Apache WSS4J: before 1.6.5 — fixed in 1.6.5
• JBoss BRMS: 5.3
• Red Hat JBoss EAP: 5.0.0
• RedHat Jboss Enterprise Application Platform Text-Only Advisories: all versions
• RedHat Jboss Enterprise Soa Platform: 4.2.0, 4.3.0
• RedHat Jboss Enterprise Web Platform: 5.0.0
• RedHat Jboss Middleware Text-Only Advisories: all versions
• Red Hat JBoss Portal: 4.0.0
• RedHat Jboss Web Services: all versions

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache WSS4J 1.6.5. Check the vendor advisory for mitigations.

References

• http://cxf.apache.org/note-on-cve-2011-2487.html
• http://rhn.redhat.com/errata/RHSA-2013-0191.html
• http://rhn.redhat.com/errata/RHSA-2013-0192.html
• http://rhn.redhat.com/errata/RHSA-2013-0193.html
• http://rhn.redhat.com/errata/RHSA-2013-0194.html
• http://rhn.redhat.com/errata/RHSA-2013-0195.html
• http://rhn.redhat.com/errata/RHSA-2013-0196.html
• http://rhn.redhat.com/errata/RHSA-2013-0198.html
• http://rhn.redhat.com/errata/RHSA-2013-0221.html
• http://www.securityfocus.com/bid/57549
• https://bugzilla.redhat.com/show_bug.cgi?id=713539
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81737

Get alerted when CVE-2011-2487 or the next vulnerability affects your stack