Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

GoUtils: Weak Random String Generation

published 3 years ago
Summary

GoUtils' random string generator produces less secure strings than expected. This makes it easier for attackers to guess these strings, which can compromise security. Update to the latest version of GoUtils to fix this issue.

What to do
  • Update github.com masterminds to version 1.1.1.
Affected software
Ecosystem VendorProductAffected versions
go github.com masterminds < 1.1.1
Fix: upgrade to 1.1.1
Original advisory text
Duplicate Advisory: GoUtils's randomly-generated alphanumeric strings contain significantly less entropy than expected
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xg2h-wx96-xgxr. This link is maintained to preserve external references.

## Original Description
Randomly-generated alphanumeric strings contain significantly less entropy than expected. The `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.1 Critical
Type
CWE-331Insufficient Entropy
Timeline
Published28 Dec 2022
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-3839-6r69-m497 · GHSA
Track software like this
Free during beta