CVE-2019-3795
Medium
Description
Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Vmware Spring Security
PublishedApr 9, 2019
First seenApr 9, 2019
Weakness typeCWE-330CWE-330
How to fix
Update
- vmware spring_security4.2.12, 5.0.12, 5.1.5 or later
- org.springframework.security:spring-security-core4.2.12, 5.0.12, 5.1.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware spring_security | 4.2.0 ≤ v < 4.2.12, 5.0.0 ≤ v < 5.0.12, 5.1.0 ≤ v < 5.1.5 | 4.2.12, 5.0.12, 5.1.5 |
| debian debian_linux | 8.0 | — |
| org.springframework.security:spring-security-coreMaven | 4.2.0 ≤ v < 4.2.12, 5.0.0 ≤ v < 5.0.12, 5.1.0 ≤ v < 5.1.5 | 4.2.12, 5.0.12, 5.1.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.