Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2019-10754

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-g24w-373r-5pxg

Use of Insufficiently Random Values in Apereo CAS Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

gitlab/maven/org.apereo.cas/cas-server-core-services-api/CVE-2019-10754

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

gitlab/maven/org.apereo.cas/cas-server-core-services-authentication/CVE-2019-10754

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Multiple classes used within Apereo CAS make use of apache commons-lang3 `RandomStringUtils` for token and ID generation which makes them predictable due to `RandomStringUtils` PRNG's algorithm not being cryptographically strong.

gitlab/maven/org.apereo.cas/cas-server-support-oauth-core-api/CVE-2019-10754

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

gitlab/maven/org.apereo.cas/cas-server-support-oidc/CVE-2019-10754

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

gitlab/maven/org.apereo.cas/cas-server-support-shell/CVE-2019-10754

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

gitlab/maven/org.apereo.cas/cas-server-support-simple-mfa/CVE-2019-10754

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.