CVE-2021-4238

Published: Dec 27, 2022Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.

Affected (1)

Products: Goutils Project: Goutils

Goutils Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Goutils Project Goutils	Before 1.1.1

Related CWEs

Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References (4)

https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1

Source: security@golang.org

PatchThird Party Advisory

https://pkg.go.dev/vuln/GO-2022-0411

Source: security@golang.org

ExploitPatchThird Party Advisory

https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://pkg.go.dev/vuln/GO-2022-0411

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

Timeline

No history available yet.