CVE-2019-10755
Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
Résumé
Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Maven
org.pac4j:pac4j-saml
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2"}]}]
Références
- advisory nvd.nist.gov
- web github.com
- web snyk.io