GitHub Advisoryadvisory · Maven

GHSA-q3jg-4c82-j4xh Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Pivotal CredHub Service Broker

HIGH Published 2018-11-29 Modified 2022-09-14 Official page ↗
Aliases
CVE-2018-15795
Ecosystem
Maven
Packages
org.springframework.credhub:spring-credhub-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-338
Reviewed
2020-06-16

Affected packages

• Maven org.springframework.credhub:spring-credhub-core: < 1.1.0 → fixed in 1.1.0

Description

Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.

Related

Alias · CVE (1)

  • CVE-2018-15795 Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA… vulnerability

Weakness · CWE (1)

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

References