Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

The primary impact of CVE-2019-3795 lies in the predictability of random numbers generated by the affected Spring Security components. If an application relies on these random numbers for security-sensitive operations, such as generating session IDs, tokens, or encryption keys, an attacker could potentially predict these values. This could lead to session hijacking, unauthorized access to resources, or other security breaches. The vulnerability requires an honest application to provide a seed and expose the resulting random material, making exploitation dependent on specific application configurations and behaviors.

Applications heavily reliant on Spring Security for authentication and authorization, particularly those that generate cryptographic keys or session IDs using SecureRandomFactoryBean and expose the resulting random data, are at increased risk. Systems using older, unpatched versions of Spring Security (≤5.1.4.RELEASE) are directly vulnerable.

• java / server:

# Check Spring Security version
java -jar your_application.jar | grep 'Spring Security' 

• java / supply-chain:

# Check for vulnerable dependencies in Maven project
mvn dependency:tree | grep 'spring-security' 

• generic web:

# Check for potential seed exposure in application logs
grep -i 'seed=' /var/log/your_application/*.log

1. 2019-04-09Disclosure

   disclosure

1. Reserviert2019-01-03
2. Veröffentlicht2019-04-09
3. Geändert2024-09-17
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2019-3795 is to upgrade to a version of Spring Security that addresses the vulnerability. Specifically, upgrade to version 5.1.4.RELEASE or later. If upgrading is not immediately feasible, consider isolating the SecureRandomFactoryBean and limiting its exposure to external access. Review application code to ensure that random numbers generated by SecureRandomFactoryBean are not exposed or predictable. While not a direct fix, implementing robust input validation and security monitoring can help detect and respond to potential exploitation attempts.