PT-2019-16725 · Spring · Spring Security

Thijs Alkemade · Published 2019-04-09 · Updated 2021-11-02 · CVE-2019-3795

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring Security versions 4.2.x prior to 4.2.12 Spring Security versions 5.0.x prior to 5.0.12 Spring Security versions 5.1.x prior to 5.1.5

Description The issue concerns an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. To be impacted, an application must provide a seed and make the resulting random material available to an attacker for inspection.

Recommendations For Spring Security versions 4.2.x prior to 4.2.12, update to version 4.2.12 or later. For Spring Security versions 5.0.x prior to 5.0.12, update to version 5.0.12 or later. For Spring Security versions 5.1.x prior to 5.1.5, update to version 5.1.5 or later.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2019-3795

DLA-1794-1

GHSA-V2R2-7QM7-JJ6V

Affected Products

Spring Security

References · 12

• https://pivotal.io/security/cve-2019-3795 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3795 · Security Note
• https://osv.dev/vulnerability/GHSA-v2r2-7qm7-jj6v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3795 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1794-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/libspring-security-2.0-java · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3795 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1794-1 · Vendor Advisory
• http://securityfocus.com/bid/107802 · Note
• https://packages.debian.org/src:libspring-security-2.0-java · Note
• https://lists.debian.org/debian-lts-announce/2019/05/msg00026.html · Note
• https://github.com/advisories/GHSA-v2r2-7qm7-jj6v · Note