Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml

MOYENNE 4.9CVE-2019-10755 · GHSA-rc75-cf5c-mxvh · SNYK-JAVA-ORGPAC4J-467407 · Published 23/09/2019 · updated 17/06/2026

En bref

CVE-2019-10755 est une vulnérabilité MOYENNE (CVSS 4.9) touchant org.pac4j:pac4j-saml, pac4j (pac4j).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.1%, plus élevée que 66.6% des vulnérabilités.
Correctif : mettre à jour vers 3.8.2 ou plus récent.

Package	Affected versions	Patched versions
org.pac4j:pac4j-saml Maven	`< 3.8.2`	`3.8.2`
pac4j pac4j	`≥ 3.0.0, ≤ 3.8.2`	No fix yet

Description

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-10755 · ADVISORY
pac4j/pac4j commit 34d5b10 · WEB
snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free