Insecure Random

[FanjunMeng]

kaptcha/src/main/java/com/google/code/kaptcha/text/impl/DefaultTextCreator.java

Line 21 in f998397

Random rand = new Random();

kaptcha/src/main/java/com/google/code/kaptcha/text/impl/ChineseTextProducer.java

Line 22 in f998397

return simplifiedChineseTexts[new Random().nextInt(simplifiedChineseTexts.length)];

kaptcha/src/main/java/com/google/code/kaptcha/text/impl/FiveLetterFirstNameTextCreator.java

Line 1059 in f998397

Random rand = new Random();

I think it should be use a secure random algorithm “SecureRandom” to generate verifycode
An attacker will simply compute the seed from the output values observed. This takes significantly less time than 2^48 in the case of java.util.Random.
It is shown that you can predict future Random outputs observing only two(!) output values in time roughly 2^16.

[helloworldtang]

mark

[aichaoxy]

Since Github has kept giving alert on the insufficient randomness in this project, I suggest that we replace all the usage of new Random() with new SecureRandom() to avoid the risk.

CVE-2018-18531

[aichaoxy]

#4

[hurelhuyag]

Any release since this change?

[wxy8866]

Please merge this pull request and push a new release.

[uniquejava]

@penggle

[isaclutz]

Is it possible to publish a new version to mvnrepository? https://mvnrepository.com/artifact/com.github.penggle/kaptcha

The version here on githab has the fix for CVE-2018-18531 but the version number in the build files is still 2.3.2, which was published in 2015. Can we build and publish the current source with a patch version (2.3.3?)

[wxy8866]

It's out of maintenance. Is it possible to change the owner to maintain this project?