GHSA-v2r2-7qm7-jj6v

Suggest an improvement
Source
https://github.com/advisories/GHSA-v2r2-7qm7-jj6v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/04/GHSA-v2r2-7qm7-jj6v/GHSA-v2r2-7qm7-jj6v.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-v2r2-7qm7-jj6v
Aliases
Published
2019-04-16T15:10:59Z
Modified
2023-11-08T04:01:34.281605Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Spring Security uses insufficiently random values
Details

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:56:26Z",
    "nvd_published_at": "2019-04-09T16:29:00Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-330"
    ]
}
References

Affected packages

Maven

org.springframework.security:spring-security-core

Package

Name
org.springframework.security:spring-security-core
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.security/spring-security-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0
Fixed
4.2.12

Affected versions

4.*

4.2.0.RELEASE
4.2.1.RELEASE
4.2.2.RELEASE
4.2.3.RELEASE
4.2.4.RELEASE
4.2.5.RELEASE
4.2.6.RELEASE
4.2.7.RELEASE
4.2.8.RELEASE
4.2.9.RELEASE
4.2.10.RELEASE
4.2.11.RELEASE

org.springframework.security:spring-security-core

Package

Name
org.springframework.security:spring-security-core
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.security/spring-security-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.0.12

Affected versions

5.*

5.0.0.RELEASE
5.0.1.RELEASE
5.0.2.RELEASE
5.0.3.RELEASE
5.0.4.RELEASE
5.0.5.RELEASE
5.0.6.RELEASE
5.0.7.RELEASE
5.0.8.RELEASE
5.0.9.RELEASE
5.0.10.RELEASE
5.0.11.RELEASE

org.springframework.security:spring-security-core

Package

Name
org.springframework.security:spring-security-core
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.security/spring-security-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.1.0
Fixed
5.1.5

Affected versions

5.*

5.1.0.RELEASE
5.1.1.RELEASE
5.1.2.RELEASE
5.1.3.RELEASE
5.1.4.RELEASE