com.swisscom.cloud.sb:broker (>=4.0.0, <=4.2.5), org.springframework.credhub:spring-credhub-cloud-connector (>=1.0.0.release, <=1.0.1.release) +1 more potentially affected by CVE-2018-15795 via org.springframework.credhub:spring-credhub-core (>=1.0.0.release, <=1.0.1.release)

org.springframework.credhub:spring-credhub-core MAVEN version =1.0.0.release, =4.0.0, =1.0.0.release, =1.0.0.release, =1.0.1.release Source cves: CVE-2018-15795 Source advisory: OSV:GHSA-Q3JG-4C82-J4XH...

CVE-2018-15795

The CVE-2018-15795 entry concerns Pivotal CredHub Service Broker, prior to version 1.1.0, which uses a guessable random-number generation method when creating the service broker’s UAA client. The underlying issue is a weak PRNG that enables a remote attacker to guess the client secret and obtain ...