| Package | Affected versions | Patched versions |
|---|---|---|
| jboss data grid | = 7.0.0 | |
| jboss enterprise application platform | = 7.0.0 | |
| jboss fuse | = 7.0.0 | |
| single sign-on | = 7.0 | |
| wildfly | = 7.2.0= 7.2.3= 7.2.5 |
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free