Ya Xiao created AVRO-3025:
-----------------------------
Summary: Using a cryptographically weak Pseudo Random Number
Generator (PRNG)
Key: AVRO-3025
URL: https://issues.apache.org/jira/browse/AVRO-3025
Project: Apache Avro
Issue Type: Improvement
Reporter: Ya Xiao
We are a security research team at Virginia Tech. We are doing an empirical
study about the usefulness of the existing security vulnerability detection
tools. The following is a reported vulnerability by certain tools. We'll so
appreciate it if you can give any feedback on it.
*Vulnerability Description:*
In file
[avro/lang/java/ipc/src/test/java/org/apache/avro/TestProtocolSpecific.java|https://github.com/apache/avro/blob/master/lang/java/ipc/src/test/java/org/apache/avro/TestProtocolSpecific.java]
, use java.util.Random instead of java.security.SecureRandom at Line 177.
*Security Impact:*
Java.util.Random is not cryptographically strong and may expose sensitive
information to certain types of attacks when used in a security context.
*Useful Resources*:
[https://cwe.mitre.org/data/definitions/338.html]
*Solution we suggest:*
Replace it with SecureRandom
*Please share with us your opinions/comments if there is any:*
Is the bug report helpful?
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
