CVE-2014-8587

Name: CVE-2014-8587
Creator: NVD / NIST
Published: 2014-11-04T15:55:07.31+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.29%

Last modified Jun 17, 2026

CVE-2014-8587 is a vulnerability of currently unknown severity. SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors.. EPSS estimates a 1.29% chance of exploitation in the next 30 days.

Description

SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors.

Metrics

EPSS Probability

1.29%

66.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-310

Affected Software

Vendor	Product	Versions
Sap	Commoncryptolib	<= 8.4.29
Sap	Sapcryptolib	<= 5.555.37
Sap	Sapseculib	All versions
Sap	Hana	All versions
Sap	Netweaver	All versions

References

http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/Broken Link
http://secunia.com/advisories/57606Not Applicable
http://service.sap.com/sap/support/notes/2067859Permissions Required
https://twitter.com/SAP_Gsupport/status/522401681997570048Broken Link
http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/Broken Link
http://secunia.com/advisories/57606Not Applicable
http://service.sap.com/sap/support/notes/2067859Permissions Required
https://twitter.com/SAP_Gsupport/status/522401681997570048Broken Link

Timeline

Published: Nov 4, 2014
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2014-8587?

How severe is CVE-2014-8587?

Severity scoring for CVE-2014-8587 is pending analysis. The EPSS model estimates a 1.29% probability of exploitation in the next 30 days.

How do I fix CVE-2014-8587?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2014-8587?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST