GitHub Advisoryadvisory · Maven

GHSA-rc75-cf5c-mxvh Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml

MEDIUM Published 2019-11-06 Modified 2021-08-18 Official page ↗
Aliases
CVE-2019-10755
Ecosystem
Maven
Packages
org.pac4j:pac4j-saml
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-338
Reviewed
2019-11-05

Affected packages

• Maven org.pac4j:pac4j-saml: < 3.8.2 → fixed in 3.8.2

Description

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.

Related

Alias · CVE (1)

  • CVE-2019-10755 The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes… vulnerability

Weakness · CWE (1)

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

References