apache/camel — pull request #80 by MrLion (2013-12-26 12:47:05+00:00)
Title: VERACODE-659,660,663, 664: Insufficient Entropy (CWE ID 331)

During Veracode scan of our application we discover several warnings in Camel. Please review our fix and apply it if it make sance.

Quote from Veracode report below:
Insufficient Entropy (CWE ID 331)(7 flaws)
Description
Standard random number generators do not provide a sufficient amount of entropy when used for security purposes.
Attackers can brute force the output of pseudorandom number generators such as rand().
Effort to Fix: 2 - Implementation error. Fix is approx. 6-50 lines of code. 1 day to fix.
Recommendations
If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the
CryptoAPI or in an open source library such as OpenSSL.