Description
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Remediation
References
https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407
Related Vulnerabilities
CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-flink-table
CVE-2018-20676 Vulnerability in maven package org.webjars.bowergithub.twbs:bootstrap
CVE-2021-4264 Vulnerability in maven package org.webjars.bower:dustjs-linkedin
CVE-2020-28452 Vulnerability in maven package com.softwaremill.akka-http-session:core_2.12
CVE-2021-31412 Vulnerability in maven package com.vaadin:flow-server