PT-2019-16725

Name of the Vulnerable Software and Affected Versions Spring Security versions 4.2.x prior to 4.2.12 Spring Security versions 5.0.x prior to 5.0.12 Spring Security versions 5.1.x prior to 5.1.5 Description The issue concerns an insecure randomness vulnerability when using...

CVE-2019-3795: Use of Insufficiently Random Values

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBeansetSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make...

Insecure Randomness

spring-security-core is vulnerable to insecure randomness. The vulnerability exists because it does not use a secure way of generating randomness in SecureRandomFactoryBeansetSeed to configure a SecureRandom instance...

CVE-2019-3778

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBeansetSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make...

br.com.anteros:anteros-security-spring (>=2.0.0, <=2.0.20), br.com.anteros:anteros-security-spring-mongo (>=1.0.0, <=1.0.5) +286 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.4.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =2.0.0, =1.0.0, =1.0.0, =1.0.6, =1.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2019-3778 Source advisory: GHSA-77RV-6VFW-X4GC...

org.mitre:openid-connect-client (>=0.9.0, <=1.0.22), org.mitre:openid-connect-common (>=0.9.0, <=1.0.22) +2 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (1.0.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security.oauth:spring-security-oauth2 and may be impacted: - org.mitre:openid-connect-client =0.9....

com.alexbt:springboot-autoconfigure-openid-oauth (1.0.9), com.appdirect:service-integration-sdk (>=v1-2.0.2, <=2.0.2) +15 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth (>=2.0.1.release, <=2.0.14.release)

org.springframework.security.oauth:spring-security-oauth MAVEN version =2.0.1.release, =v1-2.0.2, =2.2.4, =2.2.4, =2.7.4, =2.2.4, =2.2.4, =3.0.0, =2.7.4, =2.2.4, =3.0.0, =2.2.4, =2.5.2, =0.4.3, =0.4.42 and more Source cves: CVE-2019-3778 Source advisory: OSV:GHSA-77RV-6VFW-X4GC...

br.com.anteros:anteros-security-spring (>=2.0.0, <=2.0.20), br.com.anteros:anteros-security-spring-mongo (>=1.0.0, <=1.0.5) +286 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.4.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =2.0.0, =1.0.0, =1.0.0, =1.0.6, =1.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2019-3778 Source advisory: OSV:GHSA-77RV-6VFW-X4GC...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +658 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.16.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0.release, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2019-3778 Source advisory: OSV:GHSA-77RV-6VFW-X4GC...

br.com.anteros:anteros-keycloak (1.0.0), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +69 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.3.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =4.0.1 - com.ge.research.semtk:springsecuritylibrary 2.2.2 -...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2019-3778 Source advisory: OSV:GHSA-77RV-6VFW-X4GChttps://vulners.com/o...

com.alexbt:springboot-autoconfigure-openid-oauth (1.0.9), com.appdirect:service-integration-sdk (>=v1-2.0.2, <=2.0.2) +15 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth (>=2.0.1.release, <=2.0.14.release)

org.springframework.security.oauth:spring-security-oauth MAVEN version =2.0.1.release, =v1-2.0.2, =2.2.4, =2.2.4, =2.7.4, =2.2.4, =2.2.4, =3.0.0, =2.7.4, =2.2.4, =3.0.0, =2.2.4, =2.5.2, =0.4.3, =0.4.42 and more Source cves: CVE-2019-3778 Source advisory: GHSA-77RV-6VFW-X4GC...

com.ohadr.oauth2:auth-common (>=1.1.3, <=1.6.0-release), de.juplo:facebook-utils (1.0) +8 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (1.0.5.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version 1.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security.oauth:spring-security-oauth2 and may be impacted: - com.ohadr.oauth2:auth-common =1.1.3,...

org.cloudfoundry:cf-gradle-plugin (>=1.0.1, <=1.0.3), org.cloudfoundry:cf-maven-plugin (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (1.0.0.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security.oauth:spring-security-oauth2 and may be impacted: - org.cloudfoundry:cf-gradle-plugin...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +658 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.16.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0.release, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2019-3778 Source advisory: GHSA-77RV-6VFW-X4GC...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2019-3778 Source advisory: GHSA-77RV-6VFW-X4GChttps://vulners.com/githu...

br.com.anteros:anteros-keycloak (1.0.0), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +69 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.3.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =4.0.1 - com.ge.research.semtk:springsecuritylibrary 2.2.2 -...

CVE-2019-3778

The CVE-2019-3778 entry concerns an open redirect vulnerability in Spring Security OAuth where an attacker can abuse the redirect_uri parameter at the authorization endpoint to redirect a user-agent to an attacker-controlled URI, leaking the authorization code. Affected are older Spring Security ...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2019-3778 Source advisory: MEND:CVE-2019-3778https://vulners.com/mend/M...