CVE-2021-3538 go.uuid has Predictable UUID Identifiers
Predictable UUID generation in the satori/go.uuid library allows attackers to guess identifiers, potentially bypassing security controls or accessing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3538?
CVE-2021-3538 is a critical vulnerability in satori/go.uuid, published on 2 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker.
Weakness: CWE-338
Which versions are affected by CVE-2021-3538?
3 open source packages ship an affected version, including github.com/satori/go.uuid. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/satori/go.uuid Go | From 1.2.1-0.20180103161547-0ef6afb2f6cd | 1.2.1-0.20180404165556-75cca531ea76 |
github.com/satori/go.uuid Go | From 1.2.1-0.20180103161547-0ef6afb2f6cd | 1.2.1-0.20180404165556-75cca531ea76 |
github.com/satori/go.uuid Go | From 1.2.1-0.20180103161547-0ef6afb2f6cd | 1.2.1-0.20180404165556-75cca531ea76 |
Products include Satori Uuid.
How do I fix CVE-2021-3538?
Upgrade github.com/satori/go.uuid to 1.2.1-0.20180404165556-75cca531ea76 or later.
Is CVE-2021-3538 being exploited?
There is no known exploitation of CVE-2021-3538 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-NO94084, GHSA-33m6-q9v5-62r7, GO-2022-0244.