CVE-2019-3795

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-330

Affected software

Vendor	Product	Versions
Spring	Spring Security	>= 5.0, < 5.0.11.RELEASE; >= 5.1, < 5.1.4.RELEASE; >= 4.2, < 4.2.11.RELEASE

References

http://www.securityfocus.com/bid/107802Third Party Advisory, VDB Entry
https://lists.debian.org/debian-lts-announce/2019/05/msg00026.htmlMailing List, Third Party Advisory
https://pivotal.io/security/cve-2019-3795Vendor Advisory
http://www.securityfocus.com/bid/107802Third Party Advisory, VDB Entry
https://lists.debian.org/debian-lts-announce/2019/05/msg00026.htmlMailing List, Third Party Advisory
https://pivotal.io/security/cve-2019-3795Vendor Advisory

Timeline

Published: Apr 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-37975.3This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startin CVE-2019-37987.5Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A r CVE-2019-37996.5Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported CVE-2019-38007.8CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates CVE-2019-38019.8Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when CVE-2019-38025.3This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.ST CVE-2019-38037.5Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains acces CVE-2019-38047.5It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An CVE-2019-38054.7A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate CVE-2019-38068.1An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received CVE-2019-38079.8An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from auth CVE-2019-38085.4A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage gr