CVE-2019-3795: Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security
Pivotal Spring Security could provide weaker than expected security, caused by an insecure randomness flaw when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. A remote attacker could exploit this vulnerability to launch further attacks on the system.
Other sources
Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-3795?
CVE-2019-3795 is a vulnerability in Pivotal Spring Security that could provide weaker than expected security due to an insecure randomness vulnerability.
What versions of Spring Security are affected by CVE-2019-3795?
Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 are affected by CVE-2019-3795.
How can an application be impacted by CVE-2019-3795?
In order to be impacted by CVE-2019-3795, an honest application must provide a seed and make use of SecureRandomFactoryBean#setSeed to configure a SecureRandom instance.
What is the severity of CVE-2019-3795?
CVE-2019-3795 has a severity rating of 6.5 (medium).
How can I fix CVE-2019-3795?
To fix CVE-2019-3795, update to Spring Security versions 4.2.12, 5.0.12, or 5.1.5 or later.