CVE-2015-8851

Published: Jan 30, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.

Affected (1)

Products: Node Uuid Project: Node Uuid

Node Uuid Project

1 product

Node Uuid

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Node Uuid Project Node Uuid	Before 1.4.4

Related CWEs

CWE-331

Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References (8)

http://www.openwall.com/lists/oss-security/2016/04/13/8

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1327056

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://github.com/broofa/node-uuid/commit/672f3834ed02c798aa021c618d0a5666c8da000d

Source: secalert@redhat.com

Patch

https://nodesecurity.io/advisories/93

Source: secalert@redhat.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/04/13/8

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1327056

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://github.com/broofa/node-uuid/commit/672f3834ed02c798aa021c618d0a5666c8da000d

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://nodesecurity.io/advisories/93

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.