Описание
node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.
It was found that NodeJS node-uuid used Math.random() to create a GUID (Globally Unique Identifier) which does not provide enough entropy (on some platforms it only provides 32 bits) which can result in collisions of GUIDs. An attacker could use this to guess GUID values and leverage further attacks against a system using node-uuid.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Software Collections | nodejs010-nodejs-node-uuid | Affected | ||
| Red Hat OpenShift Container Platform 3.2 | atomic-openshift | Fixed | RHBA-2016:1343 | 27.06.2016 |
| Red Hat OpenShift Container Platform 3.2 | heapster | Fixed | RHBA-2016:1343 | 27.06.2016 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS2
Связанные уязвимости
node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.
node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.
node-uuid before 1.4.4 uses insufficiently random data to create a GUI ...
Insecure Entropy Source - Math.random() in node-uuid
EPSS
4.3 Medium
CVSS2