Description
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Remediation
References
https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407
Related Vulnerabilities
CVE-2020-13445 Vulnerability in maven package com.liferay:com.liferay.portal.template.freemarker
CVE-2024-36401 Vulnerability in maven package org.geoserver.web:gs-web-app
CVE-2021-33829 Vulnerability in npm package ckeditor4
CVE-2022-43429 Vulnerability in maven package com.compuware.jenkins:compuware-topaz-for-total-test
CVE-2022-31183 Vulnerability in maven package co.fs2:fs2-io_sjs1_2.13