logo

Database

Insecure generation of random numbers In org.apache.streampipes:streampipes-resource-management

Description

Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account. This issue affects Apache StreamPipes: from 0.69.0 through 0.93.0.

Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2024-298682. NVD-2024-298683. OSV-2024-298684. GCVE-2024-29868

References

1. https://github.com/apache/streampipes/commit/1d94191c49617dffbcb6f6d8fd73bcd5dd597d522. https://lists.apache.org/thread/g7t7zctvq2fysrw1x17flnc12592nhx73. http://www.openwall.com/lists/oss-security/2024/06/22/14. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29868.yaml5. https://github.com/DEVisions/CVE-2024-29868

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.