{"id":"GHSA-54mg-vgrp-mwx9","summary":"Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack","details":"Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.","aliases":["CVE-2019-11808"],"modified":"2023-11-08T04:01:02.010246Z","published":"2019-05-14T04:01:37Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2019-05-14T03:48:09Z","nvd_published_at":"2019-05-07T07:29:00Z","cwe_ids":["CWE-338"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11808"},{"type":"WEB","url":"https://github.com/ratpack/ratpack/issues/1448"},{"type":"WEB","url":"https://github.com/ratpack/ratpack/commit/f2b63eb82dd71194319fd3945f5edf29b8f3a42d"},{"type":"WEB","url":"https://github.com/ratpack/ratpack/releases/tag/v1.6.1"}],"affected":[{"package":{"name":"io.ratpack:ratpack-session","ecosystem":"Maven","purl":"pkg:maven/io.ratpack/ratpack-session"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}],"versions":["0.9.0","0.9.1","0.9.10","0.9.11","0.9.12","0.9.13","0.9.14","0.9.15","0.9.16","0.9.17","0.9.18","0.9.19","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0-rc-1","1.0.0-rc-2","1.0.0-rc-3","1.1.0","1.1.1","1.2.0","1.2.0-RC-1","1.2.0-rc-2","1.3.0","1.3.0-rc-1","1.3.0-rc-2","1.3.1","1.3.2","1.3.3","1.4.0","1.4.0-rc-1","1.4.0-rc-2","1.4.0-rc-3","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.0-rc-1","1.6.0-rc-2","1.6.0-rc-3","1.6.0-rc-4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-54mg-vgrp-mwx9/GHSA-54mg-vgrp-mwx9.json"}},{"package":{"name":"io.ratpack:ratpack-java","ecosystem":"Maven","purl":"pkg:maven/io.ratpack/ratpack-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-54mg-vgrp-mwx9/GHSA-54mg-vgrp-mwx9.json"}},{"package":{"name":"io.ratpack:ratpack-groovy","ecosystem":"Maven","purl":"pkg:maven/io.ratpack/ratpack-groovy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}],"versions":["0.9.0","0.9.1","0.9.10","0.9.11","0.9.12","0.9.13","0.9.14","0.9.15","0.9.16","0.9.17","0.9.18","0.9.19","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0-rc-1","1.0.0-rc-2","1.0.0-rc-3","1.1.0","1.1.1","1.2.0","1.2.0-RC-1","1.2.0-rc-2","1.3.0","1.3.0-rc-1","1.3.0-rc-2","1.3.1","1.3.2","1.3.3","1.4.0","1.4.0-rc-1","1.4.0-rc-2","1.4.0-rc-3","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.0-rc-1","1.6.0-rc-2","1.6.0-rc-3","1.6.0-rc-4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-54mg-vgrp-mwx9/GHSA-54mg-vgrp-mwx9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}