Description (CNA)
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / PAC4J For SAML Protocol | affected All versions prior to version 4.0.0-RC1 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.