Duplicate Advisory: GoUtils's randomly-generated alphanumeric strings contain significantly less entropy than expected

緊急 9.1CVE-2021-4238 · GHSA-3839-6r69-m497 · GHSA-xg2h-wx96-xgxr · 27/12/2022 公開 · 17/06/2026 更新

要点

CVE-2021-4238 は github.com/Masterminds/goutils, goutils (goutils project) に影響する深刻度「緊急」 (CVSS 9.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.4%（全脆弱性の 72.8% より高い）。
対処：1.1.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/Masterminds/goutils Go	`< 1.1.1`	`1.1.1`
goutils goutils_project	`< 1.1.1`	`1.1.1`

概要

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-xg2h-wx96-xgxr. This link is maintained to preserve external references.

Original Description

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.

NVD の説明

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.