PT-2021-20903 · Go.Uuid · Go.Uuid

Josselin-C · Publicado 2021-06-02 · Atualizado 2026-04-01 · CVE-2021-3538

Positive Technologies (AI Summary) · Pt

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

**Nome do software vulnerável e versões afetadas:

Versões do github.com/satori/go.uuid desde o commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c até d91630c8510268e75203009fe7daf2b8e1d60c45

Descrição:

Uma falha no pacote github.com/satori/go.uuid faz com que os UUIDs gerados sejam previsíveis para um invasor devido à aleatoriedade insegura na função g.rand.Read. Esse problema pode resultar em UUIDs previsíveis e possíveis colisões, já que os dados aleatórios usados para criar UUIDs podem conter zeros.

Recomendações:

Para versões do commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c até d91630c8510268e75203009fe7daf2b8e1d60c45, considere usar um método alternativo para gerar UUIDs que garanta aleatoriedade segura ou evite usar a função g.rand.Read até que um patch esteja disponível. Como solução temporária, considere implementar verificações adicionais para detectar e lidar com UUIDs previsíveis.

Correção

Enumeração de Fraquezas

CWE-338

Identificadores relacionados

CLEANSTART-2026-AP81168

CLEANSTART-2026-EE52954

CLEANSTART-2026-KW24478

CLEANSTART-2026-LB23787

CLEANSTART-2026-MT27167

CLEANSTART-2026-OS42112

CLEANSTART-2026-PE63912

CLEANSTART-2026-QY63788

CLEANSTART-2026-VZ76006

CVE-2021-3538

GHSA-33M6-Q9V5-62R7

GO-2022-0244

SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488

Produtos afetados

Go.Uuid

Referências · 98

• https://github.com/satori/go.uuid/issues/73 · Nota
• https://github.com/satori/go.uuid/commit/75cca531ea763666bc46e531da3b4c3b95f64557 · Nota
• https://github.com/satori/go.uuid/pull/75 · Nota
• https://github.com/satori/go.uuid · Nota
• https://github.com/hpcng/sif/security/advisories/GHSA-33m6-q9v5-62r7 · Nota
• https://github.com/apptainer/sif/security/advisories/GHSA-33m6-q9v5-62r7 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AP81168.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OS42112.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LB23787.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EE52954.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-VZ76006.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-MT27167.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KW24478.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-QY63788.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PE63912.json · Nota