[jira] [Created] (AVRO-3025) Using a cryptographically weak Pseudo Random Number Generator (PRNG)

["Ya Xiao (Jira)" <ji...@apache.org>]

Ya Xiao created AVRO-3025:
-----------------------------

             Summary: Using a cryptographically weak Pseudo Random Number Generator (PRNG)
                 Key: AVRO-3025
                 URL: https://issues.apache.org/jira/browse/AVRO-3025
             Project: Apache Avro
          Issue Type: Improvement
            Reporter: Ya Xiao


We are a security research team at Virginia Tech. We are doing an empirical study about the usefulness of the existing security vulnerability detection tools. The following is a reported vulnerability by certain tools. We'll so appreciate it if you can give any feedback on it.

*Vulnerability Description:*

In file [avro/lang/java/ipc/src/test/java/org/apache/avro/TestProtocolSpecific.java|https://github.com/apache/avro/blob/master/lang/java/ipc/src/test/java/org/apache/avro/TestProtocolSpecific.java] , use java.util.Random instead of java.security.SecureRandom at Line 177.

*Security Impact:*

Java.util.Random is not cryptographically strong and may expose sensitive information to certain types of attacks when used in a security context.

*Useful Resources*:

[https://cwe.mitre.org/data/definitions/338.html]

*Solution we suggest:*

Replace it with SecureRandom

*Please share with us your opinions/comments if there is any:*

Is the bug report helpful?



--
This message was sent by Atlassian Jira
(v8.3.4#803005)