GHSA-rc75-cf5c-mxvh
Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.pac4j:pac4j-saml | < 3.8.2 | 3.8.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
References
External links from the advisory. They lead to third-party sites.