Vulnerabilities > CVE-2019-11808 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Ratpack Project Ratpack

CVSS 3.7 - LOW

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

high complexity

ratpack-project

CWE-338

NVD

Published: 2019-05-07

Updated: 2024-11-21

Summary

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.

Vulnerable Configurations

Part	Description	Count
Application	Ratpack_Project Ratpack Project Ratpack 0.5.2 Ratpack Project Ratpack 0.6.1 Ratpack Project Ratpack 0.9.0 Ratpack Project Ratpack 0.9.1 Ratpack Project Ratpack 0.9.2 Ratpack Project Ratpack 0.9.3 Ratpack Project Ratpack 0.9.4 Ratpack Project Ratpack 0.9.5 Ratpack Project Ratpack 0.9.6 Ratpack Project Ratpack 0.9.7 Ratpack Project Ratpack 0.9.8 Ratpack Project Ratpack 0.9.9 Ratpack Project Ratpack 0.9.10 Ratpack Project Ratpack 0.9.11 Ratpack Project Ratpack 0.9.12 Ratpack Project Ratpack 0.9.13 Ratpack Project Ratpack 0.9.14 Ratpack Project Ratpack 0.9.15 Ratpack Project Ratpack 0.9.16 Ratpack Project Ratpack 0.9.17 Ratpack Project Ratpack 0.9.18 Ratpack Project Ratpack 0.9.19 Ratpack Project Ratpack 1.0.0 Ratpack Project Ratpack 1.1.0 Ratpack Project Ratpack 1.1.1 Ratpack Project Ratpack 1.2.0 Ratpack Project Ratpack 1.3.0 Ratpack Project Ratpack 1.3.1 Ratpack Project Ratpack 1.3.2 Ratpack Project Ratpack 1.3.3 Ratpack Project Ratpack 1.4.0 Ratpack Project Ratpack 1.4.1 Ratpack Project Ratpack 1.4.2 Ratpack Project Ratpack 1.4.3 Ratpack Project Ratpack 1.4.4 Ratpack Project Ratpack 1.4.5 Ratpack Project Ratpack 1.4.6 Ratpack Project Ratpack 1.5.0 Ratpack Project Ratpack 1.5.1 Ratpack Project Ratpack 1.5.2 Ratpack Project Ratpack 1.5.3 Ratpack Project Ratpack 1.5.4 Ratpack Project Ratpack 1.6.0	60

Common Weakness Enumeration (CWE)

CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References