GHSA-q3jg-4c82-j4xh
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Pivotal CredHub Service Broker
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.credhub:spring-credhub-core | < 1.1.0 | 1.1.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.
References
External links from the advisory. They lead to third-party sites.