CVE-2025-59390-

CVE-2025-59390- 첨부된 PoC를 사용하면 Apache Druid의 Kerberos 서명과 ThreadLocalRandom으로 생성된 모든 정수를 크랙할 수 있습니다. 권고 - Apache Druid의 Kerberos 인증자는 druid.auth.authenticator.kerberos.cookieSignatureSecret 구성이 명시적으로 설정되지 않은 경우 취약한 폴백 시크릿을 사용합니다. 이 경우 시크릿은 암호학적으로 안전하지 않은 난수 생성기인 ThreadLocalRandom을 사용하여 생성됩니다. 이로 인...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

CVE-2019-11808

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

Design/Logic Flaw

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

CVE-2019-11808

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...