wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use

🗓️ 28 May 2020 15:58:41Reported by RedHatType

Wildfly with OpenSSL provider ignores enabled protocols, enabling TLS downgrade and data leak.

Reporter	Title	Published	Views	Family All 49
BDU FSTEC	The vulnerability of the Wildfly application server, related to insufficient handling of exceptional states, allows attackers to compromise the confidentiality and integrity of the protected information.	24 Dec 202000:00	–	bdu_fstec
CNVD	Red Hat Wildfly Encryption Problem Vulnerability	19 Mar 202000:00	–	cnvd
CVE	CVE-2019-14887	16 Mar 202014:48	–	cve
Cvelist	CVE-2019-14887	16 Mar 202014:48	–	cvelist
EUVD	EUVD-2019-5996	7 Oct 202500:30	–	euvd
NVD	CVE-2019-14887	16 Mar 202015:15	–	nvd
OSV	RHSA-2020:0804 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 6 security update	27 Sep 202415:10	–	osv
OSV	RHSA-2020:0805 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 7 security update	27 Sep 202415:10	–	osv
OSV	RHSA-2020:0806 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 8 security update	27 Sep 202415:10	–	osv
OSV	RHSA-2020:0962 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update	16 Sep 202403:20	–	osv

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2019-14887
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-14887
cve	www.cve.org/CVERecord

08 Aug 2026 18:29Current

5.8Medium risk

Vulners AI Score5.8

CVSS 26.4

CVSS 3.19.1

CVSS 37.4

EPSS0.01095