io.ratpack:ratpack-pac4j (0.9.19) potentially affected by CVE-2019-11808 via io.ratpack:ratpack-session (0.9.19)

io.ratpack:ratpack-session MAVEN version 0.9.19 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-session and may be impacted: - io.ratpack:ratpack-pac4j 0.9.19 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

io.ratpack:ratpack-groovy-test (0.9.7) potentially affected by CVE-2019-11808 via io.ratpack:ratpack-groovy (0.9.7)

io.ratpack:ratpack-groovy MAVEN version 0.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-groovy and may be impacted: - io.ratpack:ratpack-groovy-test 0.9.7 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

io.ratpack:ratpack-groovy-test (0.9.4) potentially affected by CVE-2019-11808 via io.ratpack:ratpack-groovy (0.9.4)

io.ratpack:ratpack-groovy MAVEN version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-groovy and may be impacted: - io.ratpack:ratpack-groovy-test 0.9.4 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

io.ratpack:ratpack-groovy-test (0.9.3) potentially affected by CVE-2019-11808 via io.ratpack:ratpack-groovy (0.9.3)

io.ratpack:ratpack-groovy MAVEN version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-groovy and may be impacted: - io.ratpack:ratpack-groovy-test 0.9.3 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

com.bytekast.serverless-local-apigateway:com.bytekast.serverless-local-apigateway.gradle.plugin (>=0.4-snapshot, <=0.5), gradle.plugin.com.bytekast:serverless-local-apigateway (>=0.4-snapshot, <=0.5) +1 more potentially affected by CVE-2019-11808 via io.ratpack:ratpack-groovy (>=1.0.0-rc-1, <=1.6.0)

io.ratpack:ratpack-groovy MAVEN version =1.0.0-rc-1, =0.4-snapshot, =0.4-snapshot, =1.0.0-rc-1, =1.6.0 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

com.github.grooviter:gql-ratpack (0.5.0), io.ratpack:ratpack-pac4j (>=1.0.0-rc-1, <=1.6.0) +2 more potentially affected by CVE-2019-11808 via io.ratpack:ratpack-session (>=1.0.0-rc-1, <=1.6.0)

io.ratpack:ratpack-session MAVEN version =1.0.0-rc-1, =1.0.0-rc-1, =1.0.0-rc-1, =1.4.6, =3.0.0 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

io.ratpack:ratpack-pac4j (0.9.7) potentially affected by CVE-2019-11808 via io.ratpack:ratpack-session (0.9.7)

io.ratpack:ratpack-session MAVEN version 0.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-session and may be impacted: - io.ratpack:ratpack-pac4j 0.9.7 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

io.ratpack:ratpack-pac4j (0.9.3) potentially affected by CVE-2019-11808 via io.ratpack:ratpack-session (0.9.3)

io.ratpack:ratpack-session MAVEN version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-session and may be impacted: - io.ratpack:ratpack-pac4j 0.9.3 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

io.ratpack:ratpack-pac4j (0.9.9) potentially affected by CVE-2019-11808 via io.ratpack:ratpack-session (0.9.9)

io.ratpack:ratpack-session MAVEN version 0.9.9 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-session and may be impacted: - io.ratpack:ratpack-pac4j 0.9.9 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

io.ratpack:ratpack-groovy-test (0.9.1) potentially affected by CVE-2019-11808 via io.ratpack:ratpack-groovy (0.9.1)

io.ratpack:ratpack-groovy MAVEN version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-groovy and may be impacted: - io.ratpack:ratpack-groovy-test 0.9.1 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

CVE-2019-11808

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

CVE-2019-11808

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

Design/Logic Flaw

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

CVE-2019-11808

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

CVE-2019-11808

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

com.bytekast.serverless-local-apigateway:com.bytekast.serverless-local-apigateway.gradle.plugin (>=0.4-snapshot, <=0.5), gradle.plugin.com.bytekast:serverless-local-apigateway (>=0.4-snapshot, <=0.5) +1 more potentially affected by CVE-2019-11808 via io.ratpack:ratpack-groovy (>=0.9.0, <=1.6.0)

io.ratpack:ratpack-groovy MAVEN version =0.9.0, =0.4-snapshot, =0.4-snapshot, =0.9.0, =1.6.0 Source cves: CVE-2019-11808 Source advisory: MEND:CVE-2019-11808...

CVE-2019-11808

CVE-2019-11808 affects Ratpack versions before 1.6.1, where session IDs are generated using a cryptographically weak PRNG in the JDK’s ThreadLocalRandom. The consequence is that if an attacker can narrow the server-start window and observe a session ID, they could theoretically determine the sequ...

com.github.grooviter:gql-ratpack (0.5.0), io.ratpack:ratpack-pac4j (>=0.9.3, <=1.6.0) +2 more potentially affected by CVE-2019-11808 via io.ratpack:ratpack-session (>=0.9.3, <=1.6.0)

io.ratpack:ratpack-session MAVEN version =0.9.3, =0.9.3, =1.0.0-rc-1, =1.4.6, =3.0.0 Source cves: CVE-2019-11808 Source advisory: MEND:CVE-2019-11808...

CVE-2019-11808: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

PT-2019-12498

Name of the Vulnerable Software and Affected Versions Ratpack versions prior to 1.6.1 Description The issue arises from the generation of session IDs using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This weakness allows an attacker to potentially determine the sequence of sessi...