Overview
Spring Security is a powerful and highly customizable authentication and access-control framework for Java applications. It provides a range of security features that make it easier to secure enterprise applications.
A Insecure randomness vulnerability (CVE-2019-3795) has been found in some versions of spring-security-core from Spring Security. If an application is configured to use a set value for SecureRandomFactoryBean#setSeed, it weakens the security of any encrypted information.
Per OWASP: Insecure Randomness is defined as the use of predictable or non-cryptographically secure random number generators in security-sensitive contexts. This occurs when functions that produce deterministic and easily reproducible outputs, such as statistical PRNGs, are used instead of cryptographic PRNGs. Such randomness is insufficient for tasks where unpredictability is crucial, as attackers can exploit the predictable outputs to compromise security by guessing values used for sensitive operations like tokens, keys, or session identifiers.
This issue affects multiple versions of spring-security-core from Spring Security.
Details
Module Info
- Product: Spring Security
- Affected packages: spring-security-core
- Affected versions: <4.2.12, >=5.0.0 <5.0.12, >=5.1.0 <5.1.5
- GitHub repository: https://github.com/spring-projects/spring-security
- Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-core
- Package manager: Maven
- Fixed In: NES for Spring Security 4.2.21
Vulnerability Info
This CVE involves a feature called SecureRandomFactoryBean that creates random numbers. If someone sets it up using a “predictable seed” (a starting value that is not truly random), attackers might guess the “random” numbers. These numbers might then be used for important things like security tokens or cryptographic keys, and guessing them can put your system at risk.
Random numbers are important for keeping your application safe. If attackers can predict them, they can break into your system more easily. This might let them view private information, take over user accounts, or do other harmful actions.
Credits
- This vulnerability was publicly disclosed by Pivotal Software, Inc.
Mitigation
Spring Security 4.2.x is no longer community-supported. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Spring Security.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
