CVE-2019-10755
Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
概要
Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Maven
org.pac4j:pac4j-saml
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2"}]}]
参照URL
- advisory nvd.nist.gov
- web github.com
- web snyk.io