Headline

Red Hat Security Advisory 2023-0561-01

Red Hat Security Advisory 2023-0561-01 - Red Hat OpenShift Container Platform is Red Hat’s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

1 year ago

Packet Storm

Open in Source

#vulnerability #web #red_hat #kubernetes #jira

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: OpenShift Container Platform 4.10.51 security update
Advisory ID: RHSA-2023:0561-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2023:0561
Issue date: 2023-02-08
CVE Names: CVE-2021-4238
=====================================================================

Summary:

Red Hat OpenShift Container Platform release 4.10.51 is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description:

Red Hat OpenShift Container Platform is Red Hat’s cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as
random as they should be (CVE-2021-4238)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Solution:

For OpenShift Container Platform 4.10 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html

You can download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
can be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are:

(For x86_64 architecture)
The image digest is
sha256:d23a3b88ece36f741923552904b730c5452db698c7678cf65181fefb62ea5e2f

(For s390x architecture)
The image digest is
sha256:e27b9ca8076cc084528319a8dbf567841c7a970da95cf03bce4b724d58b70e52

(For ppc64le architecture)
The image digest is
sha256:fdbd611813766c4f5c2830610ba18c1ea40680db6ba30ce930aeccc9d7692376

(For aarch64 architecture)
The image digest is
sha256:fe5f112762feb15fcd6d9aec3de12a071bff114f18f15e5fd470a1ea64b0f8c7

All OpenShift Container Platform 4.10 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html.

Bugs fixed (https://bugzilla.redhat.com/):

2092501 - [4.10z] OCP 4.10 nightly build will fail to install if multiple NICs are defined on KVM nodes
2156729 - CVE-2021-4238 goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be

JIRA issues fixed (https://issues.jboss.org/):

OCPBUGS-1525 - package-server-manager does not migrate packageserver CSV from v0.17.0 to v0.18.3 on OCP 4.8 -> 4.9 upgrade
OCPBUGS-1987 - Insight Operator keeps rebooting on Openshift 4.10.18 in disconnected environment
OCPBUGS-5345 - WriteRequestBodies audit profile records routes/status events at RequestResponse level
OCPBUGS-5831 - Empty/missing node-sizing SYSTEM_RESERVED_ES parameter can result in kubelet not starting
OCPBUGS-5895 - [vsphere-csi-driver-operator] CSI cloud.conf doesn’t list multiple datacenters when specified
OCPBUGS-5929 - [4.10] nodeport not reachable port connection timeout
OCPBUGS-5950 - wal: max entry size limit exceeded
OCPBUGS-5990 - [4.10] unit test data race with egress ip tests
OCPBUGS-6091 - MetalLB tries to process a service with loadbalancer class set
OCPBUGS-6645 - [release-4.10] openshift4/ose-jenkins:v4.10.0 run script throws too many arguments error
OCPBUGS-6736 - [2072601] ovn-nbctl.log is never rotated

References:

https://access.redhat.com/security/cve/CVE-2021-4238
https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBY+QTW9zjgjWX9erEAQh/4g//eom28L/8Jcq+/dBwO/znzEbVoqUt7AH4
emVq0U7kscTkruESaK3FtnonqUa36cUwiQ9YHhkVRAbTjO580WFKSmzAXhC3unxl
+cupZRzPZZnv+ZKvu8A0Wtp8q1k4uGrZnjHkR7+L9CNWAUhmXvL0Tw1op2/gIPdN
rlexFG6Gg/ZbsdtAoyVT4hFM1UonKOykFKCG94IMeR5cpoLX3uyBb3u+tWobYBMj
E1WYx9poqLhjPhwQa/wZ0xRj57GK2Kun5qH79Eeip6yabwHgfQzxH0knq7/kDGMj
O862SZNWJZY+GLILgxv3uQ13I2mnBvanaVRBurUek6oTXYEBq0E5iT1txWzgda5x
BypMw9NsxcfMGMNey7DYhbX49GUGgB3t8/S0Uufc6TD6Fnym3BjOJh7YTl08wedm
3IDyyvadxQfdItwaaEMfr2Ls08LcaNurU3vajl8q76xQ5TcZp0HYF1emkofRb3gM
uUE+CW7CWzG0U9pUBqDuu0zOUIX79ovJivWmxTqWWmxJmVskWoXYkUQGjlebHC8K
TFvH1r1CFzr9uvArzIgqBCWi+988bf14ZkgeuLi/lEu1i/kWPy8XoH+k6fgYRf0C
9lY1WvBxpF4u8Df3pKiQ4ffvMp1Id2z2Q9xHDWJpS6bmDiTvMm6h6kBYMH6s4GL4
H+Fv9nSvCAg=
=EuoB
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4.13.0 on Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-16250: A flaw was found in Vault and Vault Enterprise (“Vault”). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM ident...

1 year ago

Red Hat Security Data

Open in Source

#sql #vulnerability #web #mac #google #microsoft #linux #red_hat #dos #nodejs #js #git #kubernetes #perl #aws #auth #ibm #postgres #sap #ssl

RHSA-2023:1326: Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update

Red Hat OpenShift Container Platform release 4.13.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4235: A flaw was found in go-yaml. This issue occurs due to unbounded alias chasing, where a maliciously crafted YAML file can cause the system to consume significant system resources. If p...

Red Hat Security Advisory 2023-1393-01

Red Hat Security Advisory 2023-1393-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.10.55.

1 year ago

Packet Storm

Open in Source

#sql #vulnerability #web #red_hat #git #kubernetes #c++#rpm

RHSA-2023:1270: Red Hat Security Advisory: OpenShift Container Platform 4.12.8 security update

Red Hat OpenShift Container Platform release 4.12.8 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #git #java #kubernetes #aws #ibm #rpm

Red Hat Security Advisory 2023-1159-01

Red Hat Security Advisory 2023-1159-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.11.31.

1 year ago

Packet Storm

Open in Source

#vulnerability #web #red_hat #kubernetes #rpm

Red Hat Security Advisory 2023-1170-01

Red Hat Security Advisory 2023-1170-01 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform.

1 year ago

Packet Storm

Open in Source

#vulnerability #red_hat

Red Hat Security Advisory 2023-0899-01

Red Hat Security Advisory 2023-0899-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.10.53.

1 year ago

Packet Storm

Open in Source

#vulnerability #web #red_hat #js #kubernetes #pdf #rpm #jira

Red Hat Security Advisory 2023-0774-01

Red Hat Security Advisory 2023-0774-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.28. Issues addressed include denial of service and out of bounds read vulnerabilities.

1 year ago

Packet Storm

Open in Source

#vulnerability #web #red_hat #dos #java #kubernetes #rpm #jira

Red Hat Security Advisory 2023-0770-01

Red Hat Security Advisory 2023-0770-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

1 year ago

Packet Storm

Open in Source

#vulnerability #red_hat #js #kubernetes

Red Hat Security Advisory 2023-0802-01

Red Hat Security Advisory 2023-0802-01 - An update is now available for Red Hat OpenShift GitOps 1.6. Red Hat Product Security has rated this update as having a security impact of Important.

1 year ago

Packet Storm

Open in Source

#vulnerability #red_hat #git

RHSA-2023:0804: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This issue significantly reduces the amount of entropy generated in short strings by these functio...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #dos #nodejs #js #git #java #kubernetes #aws #auth

RHSA-2023:0803: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This issue significantly reduces the amount of entropy generated in short strings by these functio...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #dos #nodejs #js #git #java #kubernetes #aws #auth #ibm

RHSA-2023:0802: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This issue significantly reduces the amount of entropy generated in short strings by these functio...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #dos #nodejs #js #git #java #kubernetes #aws #auth #ibm

RHSA-2023:0728: Red Hat Security Advisory: OpenShift Container Platform 4.12.3 security update

Red Hat OpenShift Container Platform release 4.12.3 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #mac #windows #linux #red_hat #nodejs #js #git #java #kubernetes #aws #ibm #rpm #sap

RHSA-2023:0651: Red Hat Security Advisory: OpenShift Container Platform 4.11.27 security update

Red Hat OpenShift Container Platform release 4.11.27 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This issu...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #git #java #kubernetes #aws #ibm #rpm

Red Hat Security Advisory 2023-0574-01

Red Hat Security Advisory 2023-0574-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.9.55. Issues addressed include a bypass vulnerability.

1 year ago

Packet Storm

Open in Source

#vulnerability #web #linux #red_hat #java #kubernetes #auth #ssh #rpm #jira

RHSA-2023:0574: Red Hat Security Advisory: OpenShift Container Platform 4.9.55 security update

Red Hat OpenShift Container Platform release 4.9.55 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This issue ...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #git #java #kubernetes #aws #auth #ssh #ibm #rpm

RHSA-2023:0561: Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update

Red Hat OpenShift Container Platform release 4.10.51 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This issu...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #git #java #kubernetes #aws #ibm

Red Hat Security Advisory 2023-0569-01

Red Hat Security Advisory 2023-0569-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.2. Issues addressed include a denial of service vulnerability.

1 year ago

Packet Storm

Open in Source

#vulnerability #web #red_hat #dos #js #git #kubernetes #aws #alibaba #auth #rpm #jira

Red Hat Security Advisory 2023-0565-01

Red Hat Security Advisory 2023-0565-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.26.

1 year ago

Packet Storm

Open in Source

#vulnerability #web #red_hat #js #kubernetes #rpm #jira

RHSA-2023:0565: Red Hat Security Advisory: OpenShift Container Platform 4.11.26 security update

Red Hat OpenShift Container Platform release 4.11.26 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This issu...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #git #java #kubernetes #aws #ibm #rpm

Red Hat Security Advisory 2023-0540-01

Red Hat Security Advisory 2023-0540-01 - Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation. This advisory covers the RPM packages for the release.

1 year ago

Packet Storm

Open in Source

#xss #vulnerability #red_hat #rpm #jira

Red Hat Security Advisory 2023-0449-01

Red Hat Security Advisory 2023-0449-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.1.

1 year ago

Packet Storm

Open in Source

#vulnerability #web #mac #red_hat #js #kubernetes #ibm #rpm #jira

RHSA-2023:0449: Red Hat Security Advisory: OpenShift Container Platform 4.12.1 security update

Red Hat OpenShift Container Platform release 4.12.1 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #mac #linux #red_hat #nodejs #js #java #kubernetes #aws #ibm #rpm

RHSA-2023:0540: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.6 security update

Red Hat OpenShift Service Mesh 2.1.6 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #java #kubernetes #aws #ibm #rpm

GHSA-3839-6r69-m497: GoUtils's randomly-generated alphanumeric strings contain significantly less entropy than expected

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.

2 years ago

ghsa

Open in Source

#git

CVE-2021-4238: Remove unnecessary checks on a value that is already definitely an al… · Masterminds/goutils@869801f

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.

2 years ago

CVE

Open in Source

#git