# CVE-2011-2487: Apache WSS4J and JBossWS Bleichenbacher attack in XML Encryption

Source: https://junglewise.ai/threats/cve-2011-2487-apache-wss4j-and-jbossws-bleichenbacher-attack-in-xml-encryption  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-04-22. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2011-2487 · Severity: medium · CVSS 5.9 · Published 2022-04-22

Apache WSS4J and JBossWS are security frameworks used to protect web services. A vulnerability in how these tools handle encrypted data could allow an attacker to potentially decrypt sensitive information by observing how the system responds to specific types of errors. This could lead to the exposure of confidential business data or credentials transmitted between services.

Technologies: [org.apache.ws.security:wss4j (Maven)](https://junglewise.ai/threats/technologies/org-apache-ws-security-wss4j). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2011-2487 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2011-2487 being exploited in the wild.

**How severe is CVE-2011-2487?** Medium severity, with a CVSS score of 5.9, published 22 April 2022.

**Which products and versions are affected?** Apache Software Foundation WSS4J < 1.6.5; org.apache.ws.security:wss4j (Maven) < 1.6.5, ECOSYSTEM:introduced=0,fixed=1.6.5; wss4j:wss4j (Maven) < 1.6.5, ECOSYSTEM:introduced=0,fixed=1.6.5; Red Hat JBossWS All versions prior to fix.

**Is there a fix for CVE-2011-2487?** Yes. org.apache.ws.security:wss4j (Maven): upgrade to 1.6.5 or later; wss4j:wss4j (Maven): upgrade to 1.6.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2011-2487 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2011-2487?** Check whether you run Apache Software Foundation WSS4J, org.apache.ws.security:wss4j (Maven), wss4j:wss4j (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.ws.security:wss4j (Maven): upgrade to 1.6.5 or later

  ```sh
  # set org.apache.ws.security:wss4j to 1.6.5 in your pom.xml or build.gradle
  ```

- wss4j:wss4j (Maven): upgrade to 1.6.5 or later

  ```sh
  # set wss4j:wss4j to 1.6.5 in your pom.xml or build.gradle
  ```


## Technical details

The implementations of the PKCS#1 v1.5 key transport mechanism for XML Encryption in Apache WSS4J (before 1.6.5) and JBossWS are susceptible to a Bleichenbacher oracle attack. An attacker can exploit this by sending specially crafted ciphertexts and observing the server's responses (timing or error messages) to iteratively decrypt the underlying data or recover the private key. This is a network-based attack with high complexity, as it requires a large number of probes to be successful. The vulnerability is addressed in Apache WSS4J version 1.6.5.

## Affected products

- Apache WSS4J < 1.6.5
- JBoss JBossWS All versions prior to fix

## Identifiers

- CVE-2011-2487
- GHSA-4qqf-hmv6-r6wh

## Timeline

- 2011-06-22: disclosed: Initial discovery/reporting date based on CVE ID year and Red Hat bugzilla.
- 2020-03-11: advisory: NVD publication date.
- 2022-04-22: advisory: GitHub Advisory Database publication.

## References

- [https://api.github.com/users/kmoens](https://api.github.com/users/kmoens)
- [https://github.com/kmoens](https://github.com/kmoens)
- [https://api.github.com/users/kmoens/gists%7B/gist_id%7D](https://api.github.com/users/kmoens/gists%7B/gist_id%7D)
- [https://api.github.com/users/kmoens/repos](https://api.github.com/users/kmoens/repos)
- [https://avatars.githubusercontent.com/u/5837260?v=4](https://avatars.githubusercontent.com/u/5837260?v=4)
- [https://api.github.com/users/kmoens/events%7B/privacy%7D](https://api.github.com/users/kmoens/events%7B/privacy%7D)

## Related threats

- [Apache WSS4J improper access control via wrapping attacks](https://junglewise.ai/threats/cve-2015-0227-apache-wss4j-improper-access-control-via-wrapping-attacks)
- [Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J](https://junglewise.ai/threats/cve-2015-0226-use-of-a-broken-or-risky-cryptographic-algorithm-in-apache-wss4j)
- [Improper Authentication in Apache WSS4J](https://junglewise.ai/threats/cve-2014-3623-improper-authentication-in-apache-wss4j)