Description

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.

Remediation

References

https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407

Related Vulnerabilities

CVE-2019-1003050 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2023-34238 Vulnerability in npm package gatsby-plugin-mdx

CVE-2019-19919 Vulnerability in maven package org.webjars:handlebars

CVE-2022-23305 Vulnerability in maven package log4j:log4j

CVE-2021-34079 Vulnerability in npm package docker-tester

Severity

Medium

Classification

CWE-338 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Tags

Patch Third Party Advisory