{"id":"CVE-2019-3795","published":"2019-04-09T15:29:02Z","modified":"2024-09-17T00:02:03Z","title":"Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security","vendor":"Spring","product":"Spring Security","tier":"tail","description":{"text":"Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.8,"severity":"LOW","version":"3.0","vector":"CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01921,"percentile":0.79833,"provenance":"source"},"cwes":[{"id":"CWE-330","name":"Use of Insufficiently Random Values"}],"references":[{"url":"https://pivotal.io/security/cve-2019-3795","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/107802","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00026.html","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":18.6,"factors":[{"name":"EPSS percentile","points":15.97},{"name":"CVSS severity","points":2.66}]},"vendorSlug":"spring","affectedVersions":[{"vendor":"Spring","product":"Spring Security","versions":[">= 5.0, < 5.0.11.RELEASE",">= 5.1, < 5.1.4.RELEASE",">= 4.2, < 4.2.11.RELEASE"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-core","vulnerableRanges":[">=4.2.0, <4.2.12",">=5.0.0, <5.0.12",">=5.1.0, <5.1.5"],"patched":["4.2.12","5.0.12","5.1.5"],"from":["GHSA-v2r2-7qm7-jj6v"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0437","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2019-11272","published":"2019-06-26","fixed":"4.2.13","kev":false,"link":{"from":"CVE-2019-3795","to":"CVE-2019-11272","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.security:spring-security-core","fromFixed":"4.2.12","toFixed":"4.2.13","daysApart":78}]}},{"cve":"CVE-2017-4995","published":"2017-11-27","fixed":"5.0.0.M2","kev":false},{"cve":"CVE-2018-1199","published":"2018-03-16","fixed":"5.0.1","kev":false,"link":{"from":"CVE-2018-1199","to":"CVE-2019-3795","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.security:spring-security-core","fromFixed":"5.0.1","toFixed":"5.0.12","daysApart":389},{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.security:spring-security-core","fromFixed":"4.2.4","toFixed":"4.2.12","daysApart":389}]}},{"cve":"CVE-2018-15801","published":"2018-12-19","fixed":"5.1.2","kev":false,"link":{"from":"CVE-2018-15801","to":"CVE-2019-3795","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.security:spring-security-core","fromFixed":"5.1.2","toFixed":"5.1.5","daysApart":111}]}},{"cve":"CVE-2019-3795","published":"2019-04-09","fixed":"5.1.5","kev":false},{"cve":"CVE-2020-5407","published":"2020-05-13","fixed":"5.3.2","kev":false},{"cve":"CVE-2020-5408","published":"2020-05-14","fixed":"5.3.2","kev":false,"link":{"from":"CVE-2019-3795","to":"CVE-2020-5408","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.security:spring-security-core","fromFixed":"5.1.5","toFixed":"5.1.10","daysApart":401}]}},{"cve":"CVE-2021-22119","published":"2021-06-29","fixed":"5.5.1","kev":false}],"package":"Maven:org.springframework.security:spring-security-core"}}