CVE-2021-3538

Summary

CVE	CVE-2021-3538
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-06-02 14:15:00 UTC
Updated	2021-06-14 13:37:00 UTC
Description	A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker.

Risk And Classification

Problem Types: CWE-338

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Go.uuid Project	Go.uuid	All	All	All	All

References

Reference	Source	Link	Tags
Insecure Randomness in github.com/satori/go.uuid \| Snyk	MISC	snyk.io
1954376 – (CVE-2021-3538) CVE-2021-3538 satori/go.uuid: predictable UUIDs generated via insecure randomness	MISC	bugzilla.redhat.com
NewV4: non-random uuid · Issue #73 · satori/go.uuid · GitHub	MISC	github.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

905087 Common Base Linux Mariner (CBL-Mariner) Security Update for jx (12502)
997865 GO (Go) Security Update for github.com/apptainer/sif/v2 (GHSA-33m6-q9v5-62r7)