View all vulnerabilities

CVE-2021-4238

GoUtils's randomly-generated alphanumeric strings contain significantly less entropy than expected

Description

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.
Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
9.1
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected Versions
github.com/Masterminds/goutils < 1.1.1
Severity
Critical
Critical
Critical
Ecosystem
GO
Publish Date
December 27, 2022
Modified Date
May 20, 2024