CVE-2019-10755: Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
Summary
CVE-2019-10755: Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml. Affects org.pac4j:pac4j-saml versions < 3.8.2. Fixed in 3.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.pac4j:pac4j-saml is a Maven package that provides SAML (Security Assertion Markup Language) support for the pac4j library. SAML is an XML-based open standard for exchanging authentication and authorization data between parties. The pac4j-saml package allows developers to integrate SAML-based authentication and authorization into their applications. However, the package is vulnerable to a cryptographically weak pseudo-random number generator (PRNG) issue.
Vulnerability Detail
The SAML identifier generated within SAML2Utils.java in the pac4j-saml package uses the apache commons-lang3 RandomStringUtils class, which has a PRNG algorithm that is not cryptographically strong. This makes the generated SAML identifiers predictable. An attacker could exploit this vulnerability to guess or manipulate SAML identifiers, potentially leading to unauthorized access or privilege escalation. It is important to note that this vulnerability only affects the 3.X release of pac4j-saml.
How To Fix
Minimum fixed version
3.8.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the pac4j-saml package.
Conclusion
The pac4j-saml package is vulnerable to a cryptographically weak PRNG issue in the generation of SAML identifiers. This vulnerability can be mitigated by upgrading to version 3.8.2 or later of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.pac4j:pac4j-saml →
FAQ
This vulnerability could allow an attacker to guess or manipulate SAML identifiers, potentially leading to unauthorized access or privilege escalation.
Only the 3.X release of the pac4j-saml package is affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this advisory.
Yes, developers can fix this vulnerability by upgrading to version 3.8.2 or later of the pac4j-saml package.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the pac4j-saml package.
