high8.1
CVE-2019-10754
Use of Insufficiently Random Values in Apereo CAS
Impact
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apereo.cas:cas-server-support-simple-mfa | < 6.1.0-RC5 | 6.1.0-RC5 |
| maven | org.apereo.cas:cas-server-support-oidc | < 6.1.0-RC5 | 6.1.0-RC5 |
| maven | org.apereo.cas:cas-server-core-services-api | < 6.1.0-RC5 | 6.1.0-RC5 |
| maven | org.apereo.cas:cas-server-support-oauth-core-api | < 6.1.0-RC5 | 6.1.0-RC5 |
| maven | org.apereo.cas:cas-server-support-shell | < 6.1.0-RC5 | 6.1.0-RC5 |
| maven | org.apereo.cas:cas-server-core-services-authentication | < 6.1.0-RC5 | 6.1.0-RC5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apereo | Central Authentication Service | through 6.0.5.1 Version 6.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869
- https://github.com/advisories/GHSA-g24w-373r-5pxg
- https://nvd.nist.gov/vuln/detail/CVE-2019-10754
- https://github.com/apereo/cas/commit/40bf278e66786544411c471de5123e7a71826b9f