CVE-2014-8587

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-11-04 · updated 2026-06-17
Weakness: CWE-310

Description

SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors.

Affected products

SAP_SE SAP CommonCryptoLib: through 8.4.29
SAP SE SAP HANA: all versions
SAP_SE SAP NetWeaver: all versions
Sapcryptolib: through 5.555.37
Sapseculib: all versions

References

http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/
http://secunia.com/advisories/57606
http://service.sap.com/sap/support/notes/2067859
https://twitter.com/SAP_Gsupport/status/522401681997570048
http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/
http://secunia.com/advisories/57606
http://service.sap.com/sap/support/notes/2067859
https://twitter.com/SAP_Gsupport/status/522401681997570048

Get alerted when CVE-2014-8587 or the next vulnerability affects your stack