Threats affecting pkg:maven/org.apache.tomee/tomee-embedded

Apache TomEE versions prior to 10.3.0 and 11.0.0-M2 use a non-cryptographic pseudo-random number generator (PRNG) to generate HTTP session identifiers by default. This weakness allows a remote attacker who observes a session identifier to predict other session identifiers, potentially hijacking user sessions if HTTP sessions are used for authentication. The issue is fixed in versions 10.3.0 and 11.0.0-M2.