GitHub Advisoryadvisory · Maven

GHSA-g24w-373r-5pxg Use of Insufficiently Random Values in Apereo CAS

HIGH Published 2022-05-24 Modified 2022-11-01 Official page ↗
Aliases
CVE-2019-10754
Ecosystem
Maven
Packages
org.apereo.cas:cas-server-support-simple-mfa, org.apereo.cas:cas-server-support-oidc, org.apereo.cas:cas-server-core-services-api, org.apereo.cas:cas-server-support-oauth-core-api, org.apereo.cas:cas-server-support-shell, org.apereo.cas:cas-server-core-services-authentication
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-330, CWE-338
Reviewed
2022-11-01

Affected packages

• Maven org.apereo.cas:cas-server-support-simple-mfa: < 6.1.0-RC5 → fixed in 6.1.0-RC5 • Maven org.apereo.cas:cas-server-support-oidc: < 6.1.0-RC5 → fixed in 6.1.0-RC5 • Maven org.apereo.cas:cas-server-core-services-api: < 6.1.0-RC5 → fixed in 6.1.0-RC5 • Maven org.apereo.cas:cas-server-support-oauth-core-api: < 6.1.0-RC5 → fixed in 6.1.0-RC5 • Maven org.apereo.cas:cas-server-support-shell: < 6.1.0-RC5 → fixed in 6.1.0-RC5 • Maven org.apereo.cas:cas-server-core-services-authentication: < 6.1.0-RC5 → fixed in 6.1.0-RC5

Description

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Related

Alias · CVE (1)

  • CVE-2019-10754 Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID… vulnerability

Weakness · CWE (2)

  • CWE-330 Use of Insufficiently Random Values weakness
  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

References