CVE-2018-14627

The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting allow clients to create plaintext connections: <transport-config confidentiality="required" trust-in-target="supported"/>

Score

CVSS 3.0 5.9 Medium

Status

Modified - secalert@redhat.com

Published

2018-09-04

Last modified

2024-08-05

Weaknesses

CWE-319

Affected products

• Wildfly (Redhat)
• Jbosswildfly (Unknown)

References

• https://access.redhat.com/errata/RHSA-2018:3527
• https://access.redhat.com/errata/RHSA-2018:3528
• https://access.redhat.com/errata/RHSA-2018:3529
• https://access.redhat.com/errata/RHSA-2018:3595
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14627
• https://issues.jboss.org/browse/WFLY-9107
• https://security.netapp.com/advisory/ntap-20181221-0002/