GHSA-gq67-pp9w-43gp

Suggest an improvement
Source
https://github.com/advisories/GHSA-gq67-pp9w-43gp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-gq67-pp9w-43gp/GHSA-gq67-pp9w-43gp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gq67-pp9w-43gp
Aliases
Published
2021-06-16T17:31:39Z
Modified
2024-02-17T05:33:43.782347Z
Summary
Cryptographically weak CSRF tokens in Apache MyFaces
Details

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

Mitigation: Existing web.xml configuration parameters can be used to direct MyFaces to use SecureRandom for CSRF token generation:

org.apache.myfaces.RANDOMKEYINVIEWSTATESESSIONTOKEN=secureRandom org.apache.myfaces.RANDOMKEYINCSRFSESSIONTOKEN=secureRandom org.apache.myfaces.RANDOMKEYINWEBSOCKETSESSIONTOKEN=secureRandom

References

Affected packages

Maven / org.apache.myfaces.core:myfaces-core-module

Package

Name
org.apache.myfaces.core:myfaces-core-module
View open source insights on deps.dev
Purl
pkg:maven/org.apache.myfaces.core/myfaces-core-module

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.25

Affected versions

2.*

2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24

Maven / org.apache.myfaces.core:myfaces-core-module

Package

Name
org.apache.myfaces.core:myfaces-core-module
View open source insights on deps.dev
Purl
pkg:maven/org.apache.myfaces.core/myfaces-core-module

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.1.0
Fixed
2.1.19

Affected versions

2.*

2.1.7
2.1.8
2.1.9
2.1.10
2.1.11
2.1.12
2.1.13
2.1.14
2.1.15
2.1.16
2.1.17
2.1.18

Maven / org.apache.myfaces.core:myfaces-core-module

Package

Name
org.apache.myfaces.core:myfaces-core-module
View open source insights on deps.dev
Purl
pkg:maven/org.apache.myfaces.core/myfaces-core-module

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.2.0
Fixed
2.2.14

Affected versions

2.*

2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.10
2.2.11
2.2.12
2.2.13

Maven / org.apache.myfaces.core:myfaces-core-module

Package

Name
org.apache.myfaces.core:myfaces-core-module
View open source insights on deps.dev
Purl
pkg:maven/org.apache.myfaces.core/myfaces-core-module

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.3.0
Fixed
2.3.8

Affected versions

2.*

2.3.0
2.3-next-M1
2.3-next-M2
2.3-next-M3
2.3-next-M4
2.3-next-M5
2.3-next-M6
2.3-next-M7
2.3-next-M8
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7