Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml

2019-11-0617:06:28

Google

osv.dev

0.001 Low

EPSS

Percentile

28.4%

JSON

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG’s algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.

CPENameOperatorVersion
org.pac4j:pac4j-samleq1.8.9
org.pac4j:pac4j-samleq1.8.4
org.pac4j:pac4j-samleq3.6.1
org.pac4j:pac4j-samleq1.8.1
org.pac4j:pac4j-samleq2.3.0
org.pac4j:pac4j-samleq2.2.0
org.pac4j:pac4j-samleq1.9.5
org.pac4j:pac4j-samleq3.0.0
org.pac4j:pac4j-samleq1.8.8
org.pac4j:pac4j-samleq2.1.0

Name	Operator	Version
org.pac4j:pac4j-saml	eq	1.8.9
org.pac4j:pac4j-saml	eq	1.8.4
org.pac4j:pac4j-saml	eq	3.6.1
org.pac4j:pac4j-saml	eq	1.8.1
org.pac4j:pac4j-saml	eq	2.3.0
org.pac4j:pac4j-saml	eq	2.2.0
org.pac4j:pac4j-saml	eq	1.9.5
org.pac4j:pac4j-saml	eq	3.0.0
org.pac4j:pac4j-saml	eq	1.8.8
org.pac4j:pac4j-saml	eq	2.1.0