Description

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.

Remediation

References

https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407

Related Vulnerabilities

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.tellstick

CVE-2021-27405 Vulnerability in npm package @progfay/scrapbox-parser

CVE-2020-1940 Vulnerability in maven package org.apache.jackrabbit:oak-core

CVE-2020-14445 Vulnerability in maven package org.wso2.carbon.identity.framework:org.wso2.carbon.policyeditor.ui

CVE-2022-29577 Vulnerability in maven package org.owasp.antisamy:antisamy

Severity

Medium

Classification

CWE-338 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Tags

Patch Third Party Advisory