CVE-2019-10755
Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
Summary
Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
Original description
The description as published by the source.
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Maven
org.pac4j:pac4j-saml
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2"}]}]
References
- advisory nvd.nist.gov
- web github.com
- web snyk.io