Aléatoire Insecure Lors de l'Utilisation d'une Instance SecureRandom Construite par Spring Security

The core of this vulnerability lies in the SecureRandomFactoryBean component of Spring Security. If an application uses this factory and provides a seed value, and subsequently exposes the resulting random data, an attacker can analyze this data to predict future random numbers. This predictability can be exploited to compromise security-sensitive operations that rely on randomness, such as generating session IDs, cryptographic keys, or nonces. While the CVSS score is LOW, the potential impact on applications heavily reliant on secure randomness could be significant, particularly if the seed is predictable or derived from easily obtainable information. The vulnerability doesn't allow direct code execution but weakens the overall security posture by undermining the foundation of cryptographic operations.

Applications heavily reliant on Spring Security for authentication and authorization, particularly those that generate cryptographic keys or session IDs using SecureRandomFactoryBean and expose the resulting random data, are at increased risk. Systems using older, unpatched versions of Spring Security (≤5.1.4.RELEASE) are directly vulnerable.

• java / server:

# Check Spring Security version
java -jar your_application.jar | grep 'Spring Security' 

• java / supply-chain:

# Check for vulnerable dependencies in Maven project
mvn dependency:tree | grep 'spring-security' 

• generic web:

# Check for potential seed exposure in application logs
grep -i 'seed=' /var/log/your_application/*.log

1. 2019-04-09Disclosure

   disclosure

1. Réservé2019-01-03
2. Publiée2019-04-09
3. Modifiée2024-09-17
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2019-3795 is to upgrade to Spring Security version 5.1.4.RELEASE or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Ensure that the seed provided to SecureRandomFactoryBean is truly random and not derived from predictable sources. Avoid exposing the random material generated by SecureRandomFactoryBean to external entities. Review application code to identify any instances where SecureRandomFactoryBean is used and assess the potential impact of the vulnerability. While not a direct fix, strengthening seed generation practices can reduce the likelihood of exploitation.