Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml

MEDIO 4.9CVE-2019-10755 · GHSA-rc75-cf5c-mxvh · SNYK-JAVA-ORGPAC4J-467407 · Published 23/09/2019 · updated 17/06/2026

In breve

CVE-2019-10755 è una vulnerabilità MEDIO (CVSS 4.9) che riguarda org.pac4j:pac4j-saml, pac4j (pac4j).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 66.6% delle vulnerabilità.
Correzione: aggiornare a 3.8.2 o successiva.

Package	Affected versions	Patched versions
org.pac4j:pac4j-saml Maven	`< 3.8.2`	`3.8.2`
pac4j pac4j	`≥ 3.0.0, ≤ 3.8.2`	No fix yet

Description

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-10755 · ADVISORY
pac4j/pac4j commit 34d5b10 · WEB
snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free