#23 Vulnerability report - Insufficient Entropy

[david]

Hi,

We are using jasypt 1.5 and a Veracode analysis found a vulnerability in org.jasypt.salt.RandomSaltGenerator.java line 93.

This is the report:

Insufficient Entropy (CWE ID 331)

Description
Standard random number generators do not provide a sufficient amount of entropy when used for security purposes.
Attackers can brute force the output of pseudorandom number generators such as rand().

Recommendations
If this random number is used where security is a concern, such as generating a session key or session identifier, use
a trusted cryptographic random number generator instead. These can be found on the Windows platform in the
CryptoAPI or in an open source library such as OpenSSL.

I will love to hear your opinion.
Thx in advanced!

[Anonymous]

This is also in CommonUtils.java:274 in version 1.9
Its a very simple task to use a secure random generator, would be nice to have this fixed.

[Daniel Fernandez]

Fixed in SVN trunk. Will be a included in 1.9.1