CVE-2019-3795

Name of the Vulnerable Software and Affected Versions Spring Security versions 4.2.x prior to 4.2.12 Spring Security versions 5.0.x prior to 5.0.12 Spring Security versions 5.1.x prior to 5.1.5

Description The issue concerns an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. To be impacted, an application must provide a seed and make the resulting random material available to an attacker for inspection.

Recommendations For Spring Security versions 4.2.x prior to 4.2.12, update to version 4.2.12 or later. For Spring Security versions 5.0.x prior to 5.0.12, update to version 5.0.12 or later. For Spring Security versions 5.1.x prior to 5.1.5, update to version 5.1.5 or later.