~ / search / GHSA-g24w-373r-5pxg

GHSA-g24w-373r-5pxg

Use of Insufficiently Random Values in Apereo CAS

Source: GitHub Advisory Database (reviewed) High CVE-2019-10754

Packages

EcosystemPackageAffectedFixed in
Maven org.apereo.cas:cas-server-support-simple-mfa < 6.1.0-RC5 6.1.0-RC5
Maven org.apereo.cas:cas-server-support-oidc < 6.1.0-RC5 6.1.0-RC5
Maven org.apereo.cas:cas-server-core-services-api < 6.1.0-RC5 6.1.0-RC5
Maven org.apereo.cas:cas-server-support-oauth-core-api < 6.1.0-RC5 6.1.0-RC5
Maven org.apereo.cas:cas-server-support-shell < 6.1.0-RC5 6.1.0-RC5
Maven org.apereo.cas:cas-server-core-services-authentication < 6.1.0-RC5 6.1.0-RC5

Details

As written in the advisory (Markdown source, shown as plain text).

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

References

External links from the advisory. They lead to third-party sites.