CVE-2021-4238 Insufficient randomness in github.com/Masterminds/goutils
Insufficient randomness in alphanumeric string generation reduces entropy, potentially weakening security tokens or identifiers in applications using this Go library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-4238?
CVE-2021-4238 is a critical vulnerability in github.com/Masterminds/goutils, published on 27 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.
Weakness: CWE-331
Which versions are affected by CVE-2021-4238?
5 open source packages ship an affected version, including github.com/Masterminds/goutils. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/Masterminds/goutils Go | All versions | 1.1.1 |
github.com/Masterminds/goutils Go | All versions | 1.1.1 |
github.com/Masterminds/goutils Go | All versions | 1.1.1 |
github.com/Masterminds/goutils Go | All versions | 1.1.1 |
github.com/Masterminds/goutils Go | All versions | 1.1.1 |
Linux distribution packages (5)
servicemesh Red Hat:service_mesh:2.1::el8 | All versions | 0:2.1.6-1.el8 |
servicemesh-cni Red Hat:service_mesh:2.1::el8 | All versions | 0:2.1.6-1.el8 |
servicemesh-operator Red Hat:service_mesh:2.1::el8 | All versions | 0:2.1.6-1.el8 |
servicemesh-pilot-agent Red Hat:service_mesh:2.1::el8 | All versions | 0:2.1.6-1.el8 |
servicemesh-pilot-discovery Red Hat:service_mesh:2.1::el8 | All versions | 0:2.1.6-1.el8 |
Products include Goutils Project Goutils.
How do I fix CVE-2021-4238?
Upgrade github.com/Masterminds/goutils to 1.1.1 or later.
Is CVE-2021-4238 being exploited?
There is no known exploitation of CVE-2021-4238 in the wild and no public exploit code.
Sources
Also known as AZL-41275, GHSA-3839-6r69-m497, GHSA-xg2h-wx96-xgxr, GO-2022-0411, RHSA-2023:0540, UBUNTU-CVE-2021-4238.