GHSA-mfj3-87qq-382v: Weak RNG
Impact The client nonce used in HTTP Digest authentication was generated from ThreadLocalRandom, a fast but non-cryptographic pseudorandom number generator. RFC 7616 section 3.3 requires the cnonce to be unpredictable, since it is part of what protects the Digest exchange against chosen-plaintext and precomputation attacks on the credentials. An attacker able to observe or influence enough of the generator's output could reduce the unpredictability the protocol depends on. NTLM (and, on the 3.x line, SCRAM) in this client already use SecureRandom for their own nonces; Digest did not.
Affected versions 3.x: up to and including 3.0.11 2.x: up to and including 2.16.0
Patches Fixed in 3.0.12 on the 3.x line and in 2.16.1 on the 2.x line. The cnonce is now generated with SecureRandom, matching the other authentication schemes in the client.
Workarounds None available from application code.
Details Realm.Builder's cnonce generation seeded its bytes from ThreadLocalRandom.current() rather than a SecureRandom instance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.asynchttpclient:async-http-clientto a version that resolves this vulnerability.Fixed in 2.16.1 - Upgrade
Upgrade
maven/org.asynchttpclient:async-http-clientto a version that resolves this vulnerability.Fixed in 3.0.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.0.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.16.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using async-http-client versions 3.0.11 or earlier on the 3.x line, or 2.16.0 or earlier on the 2.x line, are affected when they use HTTP Digest authentication. The issue concerns Digest cnonce generation; NTLM and, on the 3.x line, SCRAM already use SecureRandom for their nonces.
What does an attacker need to exploit the weakness?
An attacker would need to be able to observe or influence enough output from the ThreadLocalRandom generator to reduce cnonce unpredictability. Reduced unpredictability weakens protections in the Digest exchange against chosen-plaintext and credential precomputation attacks.
What should teams do if they cannot patch immediately?
No application-code workaround is available. Upgrade to 3.0.12 or later on the 3.x line, or 2.16.1 or later on the 2.x line, where Digest cnonces are generated with SecureRandom.