GitHub Advisoryadvisory · Go

GHSA-mr95-vfcf-fx9p Apache Answer: Predictable Authorization Token Using UUIDv1

LOW Published 2024-11-22 Modified 2024-11-27 Official page ↗
Aliases
CVE-2024-45719
Ecosystem
Go
Packages
github.com/apache/incubator-answer
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
Weaknesses
CWE-326
Reviewed
2024-11-22

Affected packages

• Go github.com/apache/incubator-answer: < 1.4.1 → fixed in 1.4.1

Description

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-45719 Inadequate Encryption Strength vulnerability in Apache Answer. vulnerability

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References