PT-2012-1858 · Red Hat+2 · Red Hat Jboss Enterprise Application Platform+2

David Jorm · Published 2012-01-27 · Updated 2022-05-17 · CVE-2011-4314

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenID4Java versions prior to 0.9.6 final JBoss Enterprise Application Platform versions prior to 5.1.2 Kay Framework versions prior to 1.0.2

Description The issue allows remote attackers to modify potentially sensitive Attribute Exchange (AX) information without detection via a man-in-the-middle (MITM) attack, as the message/ax/AxMessage.java in OpenID4Java does not verify that AX information is signed.

Recommendations For OpenID4Java versions prior to 0.9.6 final, update to version 0.9.6 final or later. For JBoss Enterprise Application Platform versions prior to 5.1.2, update to version 5.1.2 or later. For Kay Framework versions prior to 1.0.2, update to version 1.0.2 or later.

Fix

RCE

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-20

CWE-345

Related Identifiers

CVE-2011-4314

GHSA-J473-C3RR-RX9P

RHSA-2011:1798

RHSA-2011:1799

RHSA-2011:1800

RHSA-2011:1802

RHSA-2011:1803

RHSA-2011:1804

Affected Products

Red Hat Jboss Enterprise Application Platform

Kay Framework

Openid4Java

References · 20

• http://redhat.com/support/errata/RHSA-2011-1804.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j473-c3rr-rx9p · Vendor Advisory
• http://openid.net/2011/05/05/attribute-exchange-security-alert · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4314 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-0441.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-4314 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0519.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4314 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4314 · Vendor Advisory
• http://secunia.com/advisories/44496 · Vendor Advisory
• https://github.com/jbufu/openid4java · Note
• http://openwall.com/lists/oss-security/2011/11/17/1 · Note
• https://issues.jboss.org/browse/SOA-3597 · Note
• http://openwall.com/lists/oss-security/2011/11/16/1 · Note
• http://secunia.com/advisories/48954 · Note