CVE-2019-3795: Insufficient Entropy in PRNG

April 9, 2019 (updated May 20, 2019)

Spring Security contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

References

www.securityfocus.com/bid/107802
nvd.nist.gov/vuln/detail/CVE-2019-3795
pivotal.io/security/cve-2019-3795

Code Behaviors & Features

Detect and mitigate CVE-2019-3795 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →