CVE-2019-3795

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-3795
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3795.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-3795
Aliases
Downstream
Published
2019-04-09T16:29:01.837Z
Modified
2026-03-14T09:38:18.481895Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

References

Affected packages

Git / github.com/spring-projects/spring-security

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-security
Events
Introduced
24fcb6c45a55333e5b856b6c73f14b68ceca0e19
Fixed
f154c7d9dcdebc690bf504b812db21a6d7148caf
Introduced
62e7762e8f3f2f810b01f2c23f211de627331aa8
Fixed
8f7e9c79c3beb14f7339409c9998f7a85f01d1a4
Introduced
c073705d555d94bd271dabb16990d87a33a8284c
Fixed
1e694b1304a801bc401aee15849130a5e0b702f8
Database specific 
{
    "versions": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.12"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.12"
        },
        {
            "introduced": "5.1.0"
        },
        {
            "fixed": "5.1.5"
        }
    ]
}

Affected versions

4.*
4.2.0.RELEASE
4.2.1.RELEASE
4.2.10.RELEASE
4.2.11.RELEASE
4.2.2.RELEASE
4.2.3.RELEASE
4.2.4.RELEASE
4.2.5.RELEASE
4.2.6.RELEASE
4.2.7.RELEASE
4.2.9.RELEASE
5.*
5.0.0.M1
5.0.0.M2
5.0.0.M3
5.0.0.M4
5.0.0.M5
5.0.0.RC1
5.0.0.RELEASE
5.0.1.RELEASE
5.0.10.RELEASE
5.0.11.RELEASE
5.0.2.RELEASE
5.0.3.RELEASE
5.0.4.RELEASE
5.0.5.RELEASE
5.0.6.RELEASE
5.0.7.RELEASE
5.0.8.RELEASE
5.0.9.RELEASE
5.1.0.M1
5.1.0.M2
5.1.0.RC2
5.1.0.RELEASE
5.1.1.RELEASE
5.1.2.RELEASE
5.1.3.RELEASE
5.1.4.RELEASE

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3795.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    }
]