Описание
Use of Insufficiently Random Values in Apereo CAS
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2019-10754
- https://github.com/apereo/cas/commit/40bf278e66786544411c471de5123e7a71826b9f
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869
Пакеты
org.apereo.cas:cas-server-support-simple-mfa
< 6.1.0-RC5
6.1.0-RC5
org.apereo.cas:cas-server-support-oidc
< 6.1.0-RC5
6.1.0-RC5
org.apereo.cas:cas-server-core-services-api
< 6.1.0-RC5
6.1.0-RC5
org.apereo.cas:cas-server-support-oauth-core-api
< 6.1.0-RC5
6.1.0-RC5
org.apereo.cas:cas-server-support-shell
< 6.1.0-RC5
6.1.0-RC5
org.apereo.cas:cas-server-core-services-authentication
< 6.1.0-RC5
6.1.0-RC5
Связанные уязвимости
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.