Description
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apereo CAS | All versions prior to version 6.1.0-RC5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apereo.cas:cas-server-core-services-api | < 6.1.0-RC5 | 6.1.0-RC5 | GHSA-g24w-373r-5pxg |
| Maven | org.apereo.cas:cas-server-core-services-authentication | < 6.1.0-RC5 | 6.1.0-RC5 | GHSA-g24w-373r-5pxg |
| Maven | org.apereo.cas:cas-server-support-oauth-core-api | < 6.1.0-RC5 | 6.1.0-RC5 | GHSA-g24w-373r-5pxg |
| Maven | org.apereo.cas:cas-server-support-oidc | < 6.1.0-RC5 | 6.1.0-RC5 | GHSA-g24w-373r-5pxg |
| Maven | org.apereo.cas:cas-server-support-shell | < 6.1.0-RC5 | 6.1.0-RC5 | GHSA-g24w-373r-5pxg |
| Maven | org.apereo.cas:cas-server-support-simple-mfa | < 6.1.0-RC5 | 6.1.0-RC5 | GHSA-g24w-373r-5pxg |