GHSA-v2r2-7qm7-jj6v

Source

https://github.com/advisories/GHSA-v2r2-7qm7-jj6v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/04/GHSA-v2r2-7qm7-jj6v/GHSA-v2r2-7qm7-jj6v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v2r2-7qm7-jj6v

Aliases

CVE-2019-3795

Published

2019-04-16T15:10:59Z

Modified

2023-11-08T04:01:34.281605Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Spring Security uses insufficiently random values

Details

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

Database specific

{
    "nvd_published_at": "2019-04-09T16:29:00Z",
    "github_reviewed_at": "2020-06-16T21:56:26Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-330"
    ]
}

References

Affected packages

Maven / org.springframework.security:spring-security-core

Package

Name: org.springframework.security:spring-security-core; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.2.0

Fixed

4.2.12

Affected versions

4.*

4.2.0.RELEASE

4.2.1.RELEASE

4.2.2.RELEASE

4.2.3.RELEASE

4.2.4.RELEASE

4.2.5.RELEASE

4.2.6.RELEASE

4.2.7.RELEASE

4.2.8.RELEASE

4.2.9.RELEASE

4.2.10.RELEASE

4.2.11.RELEASE

Maven / org.springframework.security:spring-security-core

Package

Name: org.springframework.security:spring-security-core; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.0.12

Affected versions

5.*

5.0.0.RELEASE

5.0.1.RELEASE

5.0.2.RELEASE

5.0.3.RELEASE

5.0.4.RELEASE

5.0.5.RELEASE

5.0.6.RELEASE

5.0.7.RELEASE

5.0.8.RELEASE

5.0.9.RELEASE

5.0.10.RELEASE

5.0.11.RELEASE

Maven / org.springframework.security:spring-security-core

Package

Name: org.springframework.security:spring-security-core; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.1.0

Fixed

5.1.5

Affected versions

5.*

5.1.0.RELEASE

5.1.1.RELEASE

5.1.2.RELEASE

5.1.3.RELEASE

5.1.4.RELEASE