ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.1.6), ai.hyacinth.framework:core-service-gateway-server (0.5.0) +1368 more potentially affected by CVE-2019-3795 via org.springframework.security:spring-security-core (>=5.1.0.release, <=5.1.4.release)

org.springframework.security:spring-security-core MAVEN version =5.1.0.release, =0.1.2, =0.1.31, =1.0, =1.0.1.release, =1.1.0.release, =1.0.1.release, =1.1.3, =1.2.2 - cn.wangdm:account-common 0.0.1 - cn.wangdm:base-common 0.0.1 - cn.wangdm:file-common 0.0.1 - cn.wangdm:mail-common 0.0.1 -...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.11), am.ik.home:uaa-client (>=1.3.0, <=1.9.0) +1696 more potentially affected by CVE-2019-3795 via org.springframework.security:spring-security-core (>=4.2.0.release, <=4.2.11.release)

org.springframework.security:spring-security-core MAVEN version =4.2.0.release, =0.1.8, =1.3.0, =1.3.0, =1.3.0, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 - at.researchstudio.sat:won-utils-crawl 0.3 and...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.11), am.ik.home:uaa-client (>=1.3.0, <=1.9.0) +1696 more potentially affected by CVE-2019-3795 via org.springframework.security:spring-security-core (>=4.2.0.release, <=4.2.11.release)

org.springframework.security:spring-security-core MAVEN version =4.2.0.release, =0.1.8, =1.3.0, =1.3.0, =1.3.0, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 - at.researchstudio.sat:won-utils-crawl 0.3 and...

am.ik.servicebroker:cloud-karafka-service-broker (>=0.0.2, <=0.0.3), am.ik.servicebroker:shared-smysql-service-broker (>=0.0.3, <=0.0.5) +1242 more potentially affected by CVE-2019-3795 via org.springframework.security:spring-security-core (>=5.0.0.release, <=5.0.11.release)

org.springframework.security:spring-security-core MAVEN version =5.0.0.release, =0.0.2, =0.0.3, =0.0.1, =1.0.1.release, =2.0.0, =1.0.0, =1.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0.release, =3.0.1.release and more Source cves: CVE-2019-3795 Source advisory: GHSA-V2R2-7QM7-JJ6V...

ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.1.6), ai.hyacinth.framework:core-service-gateway-server (0.5.0) +1368 more potentially affected by CVE-2019-3795 via org.springframework.security:spring-security-core (>=5.1.0.release, <=5.1.4.release)

org.springframework.security:spring-security-core MAVEN version =5.1.0.release, =0.1.2, =0.1.31, =1.0, =1.0.1.release, =1.1.0.release, =1.0.1.release, =1.1.3, =1.2.2 - cn.wangdm:account-common 0.0.1 - cn.wangdm:base-common 0.0.1 - cn.wangdm:file-common 0.0.1 - cn.wangdm:mail-common 0.0.1 -...

Security fix for the ALT Linux 10 package samba version 4.10.2-alt1

April 11, 2019 Evgeny Sinelnikov 4.10.2-alt1 - Update to spring security release - Security fixes: + CVE-2019-3870 World writable files in Samba AD DC private/ dir + CVE-2019-3880 Save registry file outside share as unprivileged user...

CVE-2019-3795

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBeansetSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make...

CVE-2019-3795

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBeansetSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make...

Design/Logic Flaw

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBeansetSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make...

CVE-2019-3795

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBeansetSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make...

CVE-2019-3795 Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBeansetSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make...

CVE-2019-3795

CVE-2019-3795 affects Spring Security: insecure randomness when SecureRandomFactoryBean#setSeed is used to configure a SecureRandom. Impact requires the application to supply a seed and expose the resulting random material to an attacker. Affected releases include Spring Security 4.2.x before 4.2...

PT-2019-16725

Name of the Vulnerable Software and Affected Versions Spring Security versions 4.2.x prior to 4.2.12 Spring Security versions 5.0.x prior to 5.0.12 Spring Security versions 5.1.x prior to 5.1.5 Description The issue concerns an insecure randomness vulnerability when using...

CVE-2019-3795: Use of Insufficiently Random Values

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBeansetSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make...

Insecure Randomness

spring-security-core is vulnerable to insecure randomness. The vulnerability exists because it does not use a secure way of generating randomness in SecureRandomFactoryBeansetSeed to configure a SecureRandom instance...

CVE-2019-3778

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBeansetSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make...

br.com.anteros:anteros-keycloak (1.0.0), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +69 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.3.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =4.0.1 - com.ge.research.semtk:springsecuritylibrary 2.2.2 -...

com.alexbt:springboot-autoconfigure-openid-oauth (1.0.9), com.appdirect:service-integration-sdk (>=v1-2.0.2, <=2.0.2) +15 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth (>=2.0.1.release, <=2.0.14.release)

org.springframework.security.oauth:spring-security-oauth MAVEN version =2.0.1.release, =v1-2.0.2, =2.2.4, =2.2.4, =2.7.4, =2.2.4, =2.2.4, =3.0.0, =2.7.4, =2.2.4, =3.0.0, =2.2.4, =2.5.2, =0.4.3, =0.4.42 and more Source cves: CVE-2019-3778 Source advisory: GHSA-77RV-6VFW-X4GC...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +658 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.16.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2019-3778 Source advisory: GHSA-77RV-6VFW-X4GC...