io.ratpack:ratpack-session

1 result · Clear filters · Feed

• Low 3.7
  CVE-2019-11808

  Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack

  Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically…

  io.ratpack:ratpack-session io.ratpack:ratpack-java io.ratpack:ratpack-groovy Maven
  May 7, 2019