com.github.grooviter:gql-ratpack (=0.5.0), io.ratpack:ratpack-pac4j (>=0.9.3 <=1.10.0-milestone-39) +3 more potentially affected by CVE-2021-29481 via io.ratpack:ratpack-session (>=0.9.10 <=1.9.0-rc-2)

io.ratpack:ratpack-session MAVEN version =0.9.10, =0.9.3, =1.0.0, =1.9.0-rc-1, =1.4.6, =3.0.0 Source cves: CVE-2021-29481 Source advisory: OSV:GHSA-PHJ8-4CQ3-794G...

com.agifac.lib:app-framework (>=12.1.0 <=16.0.4), com.agifac.lib:maf-defaultplugins-extension (>=12.1.1 <=16.0.4) +281 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (>=1.5.1 <=3.1.0)

org.pac4j:pac4j-saml MAVEN version =1.5.1, =12.1.0, =12.1.1, =12.1.2, =12.1.0, =12.1.4, =1.0, =1.0, =1.9.0, =2.0.1, =16.1.0, =16.1.0, =16.1.0, =16.1.0, =16.1.0, =0.8.0, =1.1.0 and more Source cves: CVE-2019-10755 Source advisory: OSV:GHSA-RC75-CF5C-MXVH...

GHSA-RC75-CF5C-MXVH Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml...

Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml...

Insecure Random Number Generation

pac4j-saml uses an insecure random number generation. It generates entity ID with predictable randomness for SAML2 Authentication Request as it relies on random numbers generated using an insecure RandomStringUtils PRNG algorithm from apache commons-lang3 RandomStringUtil class...

CVE-2019-10755

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml...

CVE-2019-10755

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml...

Design/Logic Flaw

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml...

CVE-2019-10755

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml...

CVE-2019-10755

The CVE-2019-10755 entry concerns pac4j-saml and the 3.X release line. The issue is that the SAML identifier generated in SAML2Utils.java uses Apache Commons Lang3 RandomStringUtils, whose PRNG is not cryptographically strong, leading to predictable randomness for SAML identifiers. This weakness ...

org.apereo.cas:cas-management-webapp-configuration (>=5.3.1 <=5.3.3), org.apereo.cas:cas-management-webapp-support (>=5.3.1 <=5.3.3) +232 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (>=3.0.0-RC2 <=3.1.0)

org.pac4j:pac4j-saml MAVEN version =3.0.0-RC2, =5.3.1, =5.3.1, =5.3.1, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =5.3.3 and more Source cves: CVE-2019-10755 Source advisory: SNYK:JAVA-ORGPAC4J-467407...

Insecure Randomness

Overview org.pac4j:pac4j-saml is an is PAC4J package for the SAML Protocol. Affected versions of this package are vulnerable to Insecure Randomness. A insecure source of randomness is used to generate all of its random values as it relies upon apache commons lang3 RandomStringUtils. This SAML...

com.github.grooviter:gql-ratpack (=0.5.0), io.ratpack:ratpack-pac4j (>=0.9.3 <=1.10.0-milestone-39) +3 more potentially affected by CVE-2019-11808 via io.ratpack:ratpack-session (>=0.9.10 <=1.6.0)

io.ratpack:ratpack-session MAVEN version =0.9.10, =0.9.3, =1.0.0, =1.10.0-milestone-1, =1.4.6, =3.0.0 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

Timing Attack

pac4j-sql is vulnerable to timing attack. The password encoding of an authentication request is performed after a user is found. This causes a delay and provides hint to an attacker if the user exists...