GHSA-g24w-373r-5pxg

Suggest an improvement
Source
https://github.com/advisories/GHSA-g24w-373r-5pxg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g24w-373r-5pxg/GHSA-g24w-373r-5pxg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-g24w-373r-5pxg
Aliases
  • CVE-2019-10754
  • SNYK-JAVA-ORGAPEREOCAS-467402
  • SNYK-JAVA-ORGAPEREOCAS-467404
  • SNYK-JAVA-ORGAPEREOCAS-467406
  • SNYK-JAVA-ORGAPEREOCAS-468868
  • SNYK-JAVA-ORGAPEREOCAS-468869
Published
2022-05-24T16:56:41Z
Modified
2023-11-08T04:00:55.078712Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Use of Insufficiently Random Values in Apereo CAS
Details

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Database specific 
{
    "nvd_published_at": "2019-09-23T23:15:00Z",
    "github_reviewed_at": "2022-11-01T23:37:32Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-330",
        "CWE-338"
    ]
}
References

Affected packages

Maven / org.apereo.cas:cas-server-support-simple-mfa

Package

Name
org.apereo.cas:cas-server-support-simple-mfa
View open source insights on deps.dev
Purl
pkg:maven/org.apereo.cas/cas-server-support-simple-mfa

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.0-RC5

Affected versions

v6.*

v6.4.0-RC5
v6.4.0-RC6

6.*

6.0.0-RC1
6.0.0-RC2
6.0.0-RC3
6.0.0-RC4
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.5.1
6.0.6
6.0.7
6.0.8
6.0.8.1
6.1.0-RC1
6.1.0-RC2
6.1.0-RC3
6.1.0-RC4

Maven / org.apereo.cas:cas-server-support-oidc

Package

Name
org.apereo.cas:cas-server-support-oidc
View open source insights on deps.dev
Purl
pkg:maven/org.apereo.cas/cas-server-support-oidc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.0-RC5

Affected versions

v6.*

v6.4.0-RC5
v6.4.0-RC6

5.*

5.0.0.M1
5.0.0.M2
5.0.0.M3
5.0.0.RC1
5.0.0.RC2
5.0.0.RC3
5.0.0.RC4
5.0.0
5.0.1
5.0.2
5.0.3
5.0.3.1
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.0-RC4
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.3.10
5.3.11
5.3.12
5.3.12.1
5.3.13
5.3.14
5.3.15
5.3.15.1
5.3.16

6.*

6.0.0-RC1
6.0.0-RC2
6.0.0-RC3
6.0.0-RC4
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.5.1
6.0.6
6.0.7
6.0.8
6.0.8.1
6.1.0-RC1
6.1.0-RC2
6.1.0-RC3
6.1.0-RC4

Maven / org.apereo.cas:cas-server-core-services-api

Package

Name
org.apereo.cas:cas-server-core-services-api
View open source insights on deps.dev
Purl
pkg:maven/org.apereo.cas/cas-server-core-services-api

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.0-RC5

Affected versions

v6.*

v6.4.0-RC5
v6.4.0-RC6

5.*

5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.3.10
5.3.11
5.3.12
5.3.12.1
5.3.13
5.3.14
5.3.15
5.3.15.1
5.3.16

6.*

6.0.0-RC1
6.0.0-RC2
6.0.0-RC3
6.0.0-RC4
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.5.1
6.0.6
6.0.7
6.0.8
6.0.8.1
6.1.0-RC1
6.1.0-RC2
6.1.0-RC3
6.1.0-RC4

Maven / org.apereo.cas:cas-server-support-oauth-core-api

Package

Name
org.apereo.cas:cas-server-support-oauth-core-api
View open source insights on deps.dev
Purl
pkg:maven/org.apereo.cas/cas-server-support-oauth-core-api

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.0-RC5

Affected versions

v6.*

v6.4.0-RC5
v6.4.0-RC6

6.*

6.1.0-RC2
6.1.0-RC3
6.1.0-RC4

Maven / org.apereo.cas:cas-server-support-shell

Package

Name
org.apereo.cas:cas-server-support-shell
View open source insights on deps.dev
Purl
pkg:maven/org.apereo.cas/cas-server-support-shell

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.0-RC5

Affected versions

v6.*

v6.4.0-RC5
v6.4.0-RC6

5.*

5.0.0.M2
5.0.0.M3
5.0.0.RC1
5.0.0.RC2
5.0.0.RC3
5.0.0.RC4
5.0.0
5.0.1
5.0.2
5.0.3
5.0.3.1
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.0-RC4
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.3.10
5.3.11
5.3.12
5.3.12.1
5.3.13
5.3.14
5.3.15
5.3.15.1
5.3.16

6.*

6.0.0-RC1
6.0.0-RC2
6.0.0-RC3
6.0.0-RC4
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.5.1
6.0.6
6.0.7
6.0.8
6.0.8.1
6.1.0-RC1
6.1.0-RC2
6.1.0-RC3
6.1.0-RC4

Maven / org.apereo.cas:cas-server-core-services-authentication

Package

Name
org.apereo.cas:cas-server-core-services-authentication
View open source insights on deps.dev
Purl
pkg:maven/org.apereo.cas/cas-server-core-services-authentication

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.0-RC5

Affected versions

v6.*

v6.4.0-RC5
v6.4.0-RC6

5.*

5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.3.10
5.3.11
5.3.12
5.3.12.1
5.3.13
5.3.14
5.3.15
5.3.15.1
5.3.16

6.*

6.0.0-RC1
6.0.0-RC2
6.0.0-RC3
6.0.0-RC4
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.5.1
6.0.6
6.0.7
6.0.8
6.0.8.1
6.1.0-RC1
6.1.0-RC2
6.1.0-RC3
6.1.0-RC4