GHSA-4c72-mrhf-23cg

Apache Syncope uses a weak PNRG

Source: GitHub Advisory Database (reviewed) Moderate CVE-2014-3503

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.syncope:syncope	>= 1.1.0, < 1.1.8	1.1.8

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-3503 advisory
https://github.com/apache/syncope/commit/8e0045925a387ee211832c7e0709dd418cda1ad3 web
https://syncope.apache.org/security.html#cve-2014-3503-insecure-random-implementations-used-to-generate-p web
https://web.archive.org/web/20140728093808/http://www.securityfocus.com/bid/68431 web
https://web.archive.org/web/20201207014021/http://www.securityfocus.com/archive/1/532669/100/0/threaded web
http://packetstormsecurity.com/files/127375/Apache-Syncope-Insecure-Password-Generation.html web
http://svn.apache.org/viewvc?view=revision&revision=r1596537 web