Skip to content
CVE PROGRAM SOURCE RECORD3.8 Low

CVE-2019-3795

Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
dell

Description

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Security

  • 5.0 to < 5.0.11.RELEASEaffected
  • 5.1 to < 5.1.4.RELEASEaffected
  • 4.2 to < 4.2.11.RELEASEaffected

References