REDHAT-BUG-1954376: Medium severity satori go.uuid vulnerability
github.com/satori/go.uuid is a provides pure Go implementation of Universally Unique Identifier (UUID).
Affected versions of this package are vulnerable to Insecure Randomness producing predictable UUID identifiers due to the limited number of bytes read when using the g.rand.Read function.
References:
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488 https://github.com/satori/go.uuid/issues/73 https://github.com/satori/go.uuid/commit/d91630c8510268e75203009fe7daf2b8e1d60c45
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1954376?
The severity of REDHAT-BUG-1954376 is considered high due to the potential for predictable UUID identifiers.
How do I fix REDHAT-BUG-1954376?
To fix REDHAT-BUG-1954376, update the satori/go.uuid package to a secure version that mitigates the insecure randomness issue.
What are the implications of REDHAT-BUG-1954376?
The implications of REDHAT-BUG-1954376 include the risk of UUID collisions, which can lead to information leaks and security vulnerabilities.
Which versions of go.uuid are affected by REDHAT-BUG-1954376?
All versions of satori/go.uuid prior to the patch addressing the insecure randomness are affected by REDHAT-BUG-1954376.
Is there a workaround for REDHAT-BUG-1954376?
A temporary workaround for REDHAT-BUG-1954376 is to avoid using the UUID generation method that relies on insecure randomness until a secure version is adopted.