Riskcovery

CVE-2019-3795

Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

State
Published
Severity
3.8 Low
Published
Apr 9, 2019
Updated
Sep 17, 2024
Reserved
Jan 3, 2019

Read the record on cve.org

Description

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

Scores

CVSSScoreVectorSource
3.03.8 LowCVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:Ndell

Weaknesses

  • CWE-330 Use of Insufficiently Random Values

Affected Products

ProductVersions
Spring SecuritySpring
  • 5.0 to before 5.0.11.RELEASEAffected
  • 5.1 to before 5.1.4.RELEASEAffected
  • 4.2 to before 4.2.11.RELEASEAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.