GitHub Advisoryadvisory · npm

GHSA-265q-28rp-chq5 Insecure Entropy Source - Math.random() in node-uuid

HIGH Published 2020-04-16 Modified 2021-08-23 Official page ↗
Aliases
CVE-2015-8851
Ecosystem
npm
Packages
node-uuid
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-331
Reviewed
2020-04-16

Affected packages

• npm node-uuid: < 1.4.4 → fixed in 1.4.4

Description

Affected versions of `node-uuid` consistently fall back to using `Math.random` as an entropy source instead of `crypto`, which may result in guessable UUID's. Recommendation Update to version 1.4.4 or later.

Related

Alias · CVE (1)

  • CVE-2015-8851 node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified… vulnerability

Weakness · CWE (1)

  • CWE-331 Insufficient Entropy weakness

References