Description
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Remediation
References
https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407
Related Vulnerabilities
CVE-2021-39134 Vulnerability in npm package @npmcli/arborist
CVE-2020-10688 Vulnerability in maven package org.jboss.resteasy:resteasy-core
CVE-2018-11698 Vulnerability in npm package node-sass
CVE-2020-5207 Vulnerability in maven package io.ktor:ktor-client-cio
CVE-2018-3719 Vulnerability in maven package org.webjars.npm:mixin-deep