Go.Uuid · Go.Uuid · CVE-2021-3538
Name of the Vulnerable Software and Affected Versions:
github.com/satori/go.uuid versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45
Description:
A flaw in the github.com/satori/go.uuid package causes the generated UUIDs to be predictable for an attacker due to insecure randomness in the `g.rand.Read` function. This issue can result in predictable UUIDs and possible collisions, as the random data used to create UUIDs can contain zeros.
Recommendations:
For versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45, consider using an alternative method to generate UUIDs that ensures secure randomness, or refrain from using the `g.rand.Read` function until a patch is available. As a temporary workaround, consider implementing additional checks to detect and handle predictable UUIDs.