CVE-2021-3538

A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker.
PRNG
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 73%
VendorProductVersion
satoriuuid
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
golang-github-satori-go.uuid
bullseye
1.2.0-2
fixed
sid
1.2.0-3
fixed
trixie
1.2.0-3
fixed
bookworm
1.2.0-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
golang-github-satori-go.uuid
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
not-affected
bionic
not-affected
xenial
ignored
trusty
dne
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=1954376
https://github.com/satori/go.uuid/issues/73
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488
https://bugzilla.redhat.com/show_bug.cgi?id=1954376
https://github.com/satori/go.uuid/issues/73
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488