CVE-2011-2487: Apache Cxf

Medium severity, CVSS 5.9. EPSS: 1.8% chance of exploitation in the next 30 days.

The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.

Affected products

• Apache Cxf: from 2.4.0, up to and including 2.4.6; from 2.5.0, up to and including 2.5.2
• Apache WSS4J: before 1.6.5 (fixed in 1.6.5)
• Red Hat JBoss Business Rules Management System: version 5.3 only
• Red Hat JBoss Enterprise Application Platform: version 5.0.0 only
• Red Hat JBoss Enterprise Application Platform Text-Only Advisories: affected versions not specified
• Red Hat JBoss Enterprise Soa Platform: version 4.2.0 only; version 4.3.0 only
• Red Hat JBoss Enterprise Web Platform: version 5.0.0 only
• Red Hat JBoss Middleware Text-Only Advisories: affected versions not specified
• Red Hat JBoss Portal: version 4.0.0 only
• Red Hat JBoss Web Services: affected versions not specified

Published 2020-03-11. Last modified 2026-06-16.