GitHub Advisoryadvisory · Maven

GHSA-cf3q-vg8w-mw84 Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

CRITICAL Published 2024-06-24 Modified 2025-07-15 Official page ↗
Aliases
CVE-2024-29868
Ecosystem
Maven
Packages
org.apache.streampipes:streampipes-resource-management
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-338
Reviewed
2024-07-01

Affected packages

• Maven org.apache.streampipes:streampipes-resource-management: >= 0.69.0, < 0.95.0 → fixed in 0.95.0

Description

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account. This issue affects Apache StreamPipes: from 0.69.0 through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-29868 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password… vulnerability

Weakness · CWE (1)

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

References