Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/satori/go.uuid

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3GoPublished

    go.uuid has Predictable UUID Identifiers

    CVE-2021-3538 · GHSA-33m6-q9v5-62r7

    Affected
    • Go github.com/satori/go.uuid >= 1.2.1-0.20180103161547-0ef6afb2f6cd, < 1.2.1-0.20180404165556-75cca531ea76
    Fixed in
    1.2.1-0.20180404165556-75cca531ea76· Vendor fix available
    Issue
    CVE Description for go.uuid A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker. Update on 19 September 2024 -- This vulnerability never existed in sif The official NIST CVE-2021-3538 record says: A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. That commit and that fix were never in a tagged release of satori/go.uuid, and prior to this announcement sif had used the last tag, 1.2.0. The NIST record says version 1.2.0 was vulnerable, but that's not true. So sif was never vulnerable to this. Also, beginning with version 2.0.0, sif does not use satori/go.uuid anymore. This update was made in response to issue #243 which has more details. The original, incorrect sif…

    Recommended action: Upgrade to 1.2.1-0.20180404165556-75cca531ea76 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →