Broken or risky cryptographic algorithm in Apache WSS4J
Priority LOW 30CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 9 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-327.
Summary
The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
Why it matters now
EPSS 0.01756 78th percentileScored 2026-11-07
Fix Partial WSS4J (Apache): 1.6.5org.apache.ws.security:wss4j (Maven): 1.6.5+1 more productRed Hat: 11 advisoriesRed Hat: 9 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | WSS4J | before 1.6.5 | 1.6.5 | Patch available | CNA |
| Red Hat | JBossWS | unknown | — | No fix listed | CNA |
| — | org.apache.ws.security:wss4j (Maven) | before 1.6.5 | 1.6.5 | Patch available | GHSA-4qqf-hmv6-r6wh |
| — | wss4j:wss4j (Maven) | before 1.6.5 | 1.6.5 | Patch available | GHSA-4qqf-hmv6-r6wh |
- WSS4J VendorApache Affected before 1.6.5 Fixed in 1.6.5 Patch available CNA
- JBossWS VendorRed Hat Affected unknown Fixed in — No fix listed CNA
- org.apache.ws.security:wss4j (Maven) Vendor— Affected before 1.6.5 Fixed in 1.6.5 Patch available GHSA-4qqf-hmv6-r6wh
- wss4j:wss4j (Maven) Vendor— Affected before 1.6.5 Fixed in 1.6.5 Patch available GHSA-4qqf-hmv6-r6wh
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* | 2.4.0 – 2.4.6; 2.5.0 – 2.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:* | before 1.6.5 | Vulnerable | Apache |
| cpe:2.3:a:redhat:jboss_business_rules_management_system:5.3:*:*:*:*:*:*:* | 5.3 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:* | 5.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform_text-only_advisories:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:*:*:*:*:*:*:* | 4.2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:*:*:*:*:*:*:* | 4.3.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.0.0:*:*:*:*:*:*:* | 5.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_portal:4.0.0:*:*:*:*:*:*:* | 4.0.0 | Vulnerable | Red Hat |
- cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* Versions 2.4.0 – 2.4.6; 2.5.0 – 2.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:* Versions before 1.6.5 Vulnerable ·Apache
- cpe:2.3:a:redhat:jboss_business_rules_management_system:5.3:*:*:*:*:*:*:* Versions 5.3 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform_text-only_advisories:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_portal:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Red Hat
Remediation
- Fix · CNA WSS4J (Apache) Fixed in 1.6.5
- Fix · GHSA-4qqf-hmv6-r6wh org.apache.ws.security:wss4j (Maven) Fixed in 1.6.5 Advisory →
- Fix · GHSA-4qqf-hmv6-r6wh wss4j:wss4j (Maven) Fixed in 1.6.5 Advisory →
Red Hat 11 advisories
- RHSA-2013:0953 Released 2013-06-18 · Red Hat rating ImportantRed Hat JBoss Portal 5.2.2 security update
- Red Hat JBoss Portal 5.2
- RHSA-2013:0533 Released 2013-02-20 · Red Hat rating ImportantJBoss Enterprise SOA Platform 5.3.1 update
- Red Hat JBoss SOA Platform 5.3
- RHSA-2013:0221 Released 2013-01-31 · Red Hat rating ImportantJBoss Enterprise BRMS Platform 5.3.1 update
- JBoss Enterprise BRMS Platform 5.3
Show 8 more Red Hat advisories
- RHSA-2013:0198 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Web Platform 5.2.0 update
- Red Hat JBoss Web Platform 5.2
- RHSA-2013:0197 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Web Platform 5.2.0 update
- Red Hat JBoss Web Platform 5 for RHEL 4 AS aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
- Red Hat JBoss Web Platform 5 for RHEL 4 ES aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
- RHSA-2013:0196 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Web Platform 5.2.0 update
- Red Hat JBoss Web Platform 5 for RHEL 5 Server aopalliance-1.0-5.2.jdk6.ep5.el5, apache-cxf-2.2.12-6.1.patch_04.ep5.el5, bsh2-2.0-0.b4.15.1.patch01.ep5.el5 +47
- RHSA-2013:0195 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Web Platform 5.2.0 update
- Red Hat JBoss Web Platform 5 for RHEL 6 Server aopalliance-1.0-5.3.ep5.el6, apache-cxf-2.2.12-6.1.patch_04.ep5.el6, bsh2-2.0-0.b4.15.patch01.ep5.el6 +47
- RHSA-2013:0193 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Application Platform 5.2.0 update
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
- RHSA-2013:0191 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Application Platform 5.2.0 update
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server aopalliance-1.0-5.3.ep5.el6, apache-cxf-2.2.12-6.1.patch_04.ep5.el6, bsh2-2.0-0.b4.15.patch01.ep5.el6 +47
- RHSA-2013:0192 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Application Platform 5.2.0 update
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server aopalliance-1.0-5.2.jdk6.ep5.el5, apache-cxf-2.2.12-6.1.patch_04.ep5.el5, bsh2-2.0-0.b4.15.1.patch01.ep5.el5 +47
- RHSA-2013:0194 Released 2013-01-24 · Red Hat rating ImportantJBoss Enterprise Application Platform 5.2.0 update
- Red Hat JBoss Enterprise Application Platform 5.2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix yet |
| Red Hat JBoss Portal 4 | Affected | No fix yet |
| Red Hat JBoss Portal 5 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 4 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 5 | Affected | No fix yet |
| JBoss Enterprise BRMS Platform 5.3 | Fixed | RHSA-2013:0221 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server | Fixed | RHSA-2013:0192 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server | Fixed | RHSA-2013:0191 |
| Red Hat JBoss Enterprise Application Platform 5.2 | Fixed | RHSA-2013:0194 |
| Red Hat JBoss Portal 5.2 | Fixed | RHSA-2013:0953 |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2013:0533 |
| Red Hat JBoss Web Platform 5 for RHEL 5 Server | Fixed | RHSA-2013:0196 |
| Red Hat JBoss Web Platform 5 for RHEL 6 Server | Fixed | RHSA-2013:0195 |
| Red Hat JBoss Web Platform 5.2 | Fixed | RHSA-2013:0198 |
Timeline
- 2026-10-02 Threatist record created from CVE-2011-2487
- 2026-10-03 Alias added: GHSA-4qqf-hmv6-r6wh
References
Patch 9
- https://bugzilla.redhat.com/show_bug.cgi?id=713539
- http://rhn.redhat.com/errata/RHSA-2013-0191.html
- http://rhn.redhat.com/errata/RHSA-2013-0192.html
- http://rhn.redhat.com/errata/RHSA-2013-0193.html
- http://rhn.redhat.com/errata/RHSA-2013-0194.html
- http://rhn.redhat.com/errata/RHSA-2013-0195.html
- http://rhn.redhat.com/errata/RHSA-2013-0196.html
- http://rhn.redhat.com/errata/RHSA-2013-0198.html
- http://rhn.redhat.com/errata/RHSA-2013-0221.html
Advisory 3
Other 24
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html
- https://www.nds.ruhr-uni-bochum.de/research/publications/breaking-xml-encryption-pkcs15
- https://web.archive.org/web/20210122063156/http://www.securityfocus.com/bid/57549
- https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
- https://access.redhat.com/security/cve/CVE-2011-2487
- https://access.redhat.com/errata/RHSA-2013:0953
- https://access.redhat.com/errata/RHSA-2013:0533
- https://access.redhat.com/errata/RHSA-2013:0221
- https://access.redhat.com/errata/RHSA-2013:0198
- https://access.redhat.com/errata/RHSA-2013:0197
- https://access.redhat.com/errata/RHSA-2013:0196
- https://access.redhat.com/errata/RHSA-2013:0195
- https://access.redhat.com/errata/RHSA-2013:0194
- https://access.redhat.com/errata/RHSA-2013:0193
- https://access.redhat.com/errata/RHSA-2013:0192
- https://access.redhat.com/errata/RHSA-2013:0191
More Apache Cxf vulnerabilities
- TI-2019-09264 Incorrect authorization in Apache CXF CVSS 3.1CRITICAL 9.8
- TI-2020-10930 Apache CXF Reflected XSS in the services listing page via the styleSheetPath CVSS 3.1MEDIUM 6.1
- TI-2010-01990 Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in… CVSS 3.1CRITICAL 9.8
- TI-2022-22907 Apache CXF SSRF Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-47481 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage CVSS 3.1CRITICAL 9.8
- TI-2025-31053 Apache CXF: Untrusted JMS configuration can lead to RCE CVSS 3.1CRITICAL 9.8
Sources
- CVE-2011-2487 · CVE Program
- CVE-2011-2487 · NVD
- FIRST EPSS
- GHSA-4qqf-hmv6-r6wh · GitHub Advisory Database · CC BY 4.0
- CVE-2011-2487 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences