GHSA-v2r2-7qm7-jj6v
Spring Security uses insufficiently random values
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | >= 4.2.0, < 4.2.12 | 4.2.12 |
| Maven | org.springframework.security:spring-security-core | >= 5.0.0, < 5.0.12 | 5.0.12 |
| Maven | org.springframework.security:spring-security-core | >= 5.1.0, < 5.1.5 | 5.1.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.
References
External links from the advisory. They lead to third-party sites.