Cryptographically Weak Pseudo-Random Number Generator (PRNG) in akka-actor

Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS both classic and Artery Remoting. Akka allows configuration of custom random number generators. For historical reasons, Akka included t...

Insecure Defaults

akka-actor has insecure defaults. An attacker can leverage an ActorSystem exposed over TCP to perform Java deserialization attacks. By default Java deserialization is enabled and the documentation wasn't complete on how to disable the function.These attacks can be performed if the ActorSystem has...