CVE-2019-11808 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack

What is CVE-2019-11808?

CVE-2019-11808 is a low-severity vulnerability in n/a, published on 7 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.

Weakness: CWE-338

Which versions are affected by CVE-2019-11808?

6 open source packages ship an affected version, including io.ratpack:ratpack-groovy, io.ratpack:ratpack-java and io.ratpack:ratpack-session. It affects 1 product.

Products include Ratpack Project Ratpack.

How do I fix CVE-2019-11808?

Upgrade io.ratpack:ratpack-groovy to 1.6.1 or later.

Is CVE-2019-11808 being exploited?

There is no known exploitation of CVE-2019-11808 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-29485 Remote Code Execution Vulnerability in Session Storage Critical 9.9
• CVE-2019-17513 io.ratpack:ratpack-core vulnerable to Improper Neutralization of Special Elements in Output ('Injection') High 7.5
• CVE-2021-29479 Cached redirect poisoning via X-Forwarded-Host header High 7.0
• CVE-2021-29481 Client side sessions should not allow unencrypted storage Medium 6.5
• CVE-2021-29480 Default client side session signing key is highly predictable Medium 4.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-54mg-vgrp-mwx9.