CVE-2019-3795

CWE-3306 documents6 sources
Severity
5.3MEDIUM
EPSS
0.5%
top 32.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Spring Spring SecurityVmware Spring SecurityDebian Debian Linux
Timeline
PublishedApr 9
Latest updateApr 16

Description

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5spring/spring_security5.0 — 5.0.11.RELEASE+2
▶NVDvmware/spring_security4.2.0 — 4.2.12+2

Also affects: Debian Linux 8.0

🔴Vulnerability Details

3
GHSA
Spring Security uses insufficiently random values↗2019-04-16
▶
OSV
Spring Security uses insufficiently random values↗2019-04-16
▶
CVEList
Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security↗2019-04-09
▶

📋Vendor Advisories

1
Red Hat
spring-security-core: Insecure randomness when using a secureRandom instance constructed by Spring Security↗2019-04-02
▶

💬Community

1
Bugzilla
CVE-2019-3795 spring-security-core: Insecure randomness when using a secureRandom instance constructed by Spring Security↗2019-04-05
▶
CVE-2019-3795 (MEDIUM CVSS 5.3) | Spring Security versions 4.2.x prio | cvebase.io