OrientDB Server Community Edition uses insufficiently random values to generate session IDs
Moderate severity
GitHub Reviewed
Published
Oct 18, 2018
to the GitHub Advisory Database
•
Updated Sep 12, 2023
Package
Affected versions
< 2.0.15
= 2.1.0
Patched versions
2.0.15
2.1.1
Description
Published to the GitHub Advisory Database
Oct 18, 2018
Reviewed
Jun 16, 2020
Last updated
Sep 12, 2023
OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the
java.util.Randomclass for generation of random Session ID values in theserver/network/protocol/http/OHttpSessionManager.java, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.References