CVE-2019-14852

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
n/a	apicast	As shipped with Red Hat 3scale API Management Platform

References

https://bugzilla.redhat.com/show_bug.cgi?id=1758208Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1758208Issue Tracking, Third Party Advisory

Timeline

Published: Mar 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-148537.5An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unex CVE-2019-148546.5OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Deb CVE-2019-148557.5A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this CVE-2019-148566.5ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None CVE-2019-148576.1A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019 CVE-2019-148585.5A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub param CVE-2019-148599.1A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without CVE-2019-14866.1A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL CVE-2019-148606.5It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack CVE-2019-148615.3All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC CVE-2019-148626.1There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application CVE-2019-148636.1There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web appli