CVE-2018-14627
Summary
| CVE | CVE-2018-14627 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-09-04 12:29:00 UTC |
| Updated | 2019-10-03 00:03:00 UTC |
| Description | The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting allow clients to create plaintext connections: <transport-config confidentiality="required" trust-in-target="supported"/> |
Risk And Classification
Problem Types: CWE-319
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| [WFLY-9107] Block non-SSL IIOP port when SSL transport is required - Red Hat Issue Tracker | CONFIRM | issues.jboss.org | Third Party Advisory |
| 1624664 – (CVE-2018-14627) CVE-2018-14627 JBoss/WildFly: iiop does not honour strict transport confidentiality | CONFIRM | bugzilla.redhat.com | Issue Tracking, Patch, Third Party Advisory |
| CVE-2018-14627 Wildfly Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.