Description
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | PAC4J For SAML Protocol | All versions prior to version 4.0.0-RC1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.pac4j:pac4j-saml | < 3.8.2 | 3.8.2 | GHSA-rc75-cf5c-mxvh |