PT-2019-12029
CVE-2019-10755
·
تاريخ النشر
2019-09-23
·
تاريخ التحديث
2019-11-06
الوصف من
CVSS 3.1
4.9
متوسطةالمقاييسAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
pac4j-saml versions 3.X
Description
The issue arises from the use of the apache commons-lang3 RandomStringUtils class in SAML2Utils.java to generate SAML identifiers. This class uses a pseudorandom number generator (PRNG) algorithm that is not cryptographically strong, making the identifiers predictable.
Recommendations
For pac4j-saml version 3.X, consider using a cryptographically strong random number generator to generate SAML identifiers as a replacement for the current implementation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾