https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:55:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-228805 EUVD-2026-228805 https://cve.radiocsirt.org/vuln/euvd-2026-228805 https://cve.radiocsirt.org/vuln/fkie_cve-2021-4238 <p>Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.</p> <p>Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-4238 https://cve.radiocsirt.org/vuln/ghsa-xg2h-wx96-xgxr <p><strong>Affected:</strong> Go: github.com/Masterminds/goutils</p> <p>### Impact</p> <p>A security-sensitive bug was discovered by Open Source Developer *Erik Sundell of Sundell Open Source Consulting AB*.</p> <p>The functions `RandomAlphaNumeric(int)` and `CryptoRandomAlphaNumeric(int)` are not as random as they should be. Small values of `int` in the functions above will return a smaller subset of results than they should. For example, `RandomAlphaNumeric(1)` will always return a digit in the 0-9 range, while `RandomAlphaNumeric(4)` will return around ~7 million of the ~13M possible permutations.</p> <p>This is considered a security release because programs that rely upon random generators for passwords are at an increased risk of brute force-style password guessing. There is also a higher probability of collision.</p> <p>The problem was the result of a mistaken regular expression that only accepted random strings if they contained a digit from `[0-9]`. That restriction has been removed.</p> <p>### Patches</p> <p>This issue has been corrected in v1.1.1.</p> <p>### Workarounds</p> <p>If you cannot upgrade to v1.1.1, you can work around the issue by calling `RandomAlphaNumericCustom(N, true, true)`|`CryptoRandomAlphaNumericCustom(N, true, true)` instead. (Where `N` is the desired length, and `true` is the literal boolean `true`.)</p> <p><strong>Affected:</strong> Go: github.com/Masterminds/goutils</p> <p>### Impact</p> <p>A security-sensitive bug was discovered by Open Source Developer *Erik Sundell of Sundell Open Source Consulting AB*.</p> <p>The functions `RandomAlphaNumeric(int)` and `CryptoRandomAlphaNumeric(int)` are not as random as they should be. Small values of `int` in the functions above will return a smaller subset of results than they should. For example, `RandomAlphaNumeric(1)` will always return a digit in the 0-9 range, while `RandomAlphaNumeric(4)` will return around ~7 million of the ~13M possible permutations.</p> <p>This is considered a security release because programs that rely upon random generators for passwords are at an increased risk of brute force-style password guessing. There is also a higher probability of collision.</p> <p>The problem was the result of a mistaken regular expression that only accepted random strings if they contained a digit from `[0-9]`. That restriction has been removed.</p> <p>### Patches</p> <p>This issue has been corrected in v1.1.1.</p> <p>### Workarounds</p> <p>If you cannot upgrade to v1.1.1, you can work around the issue by calling `RandomAlphaNumericCustom(N, true, true)`|`CryptoRandomAlphaNumericCustom(N, true, true)` instead. (Where `N` is the desired length, and `true` is the literal boolean `true`.)</p> https://cve.radiocsirt.org/vuln/ghsa-xg2h-wx96-xgxr https://cve.radiocsirt.org/vuln/gsd-2021-4238 gsd-2021-4238 https://cve.radiocsirt.org/vuln/gsd-2021-4238 https://cve.radiocsirt.org/vuln/msrc_cve-2021-4238 msrc_CVE-2021-4238 https://cve.radiocsirt.org/vuln/msrc_cve-2021-4238 https://cve.radiocsirt.org/vuln/rhsa-2023:0449 <p>goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be</p> <p>goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be</p> https://cve.radiocsirt.org/vuln/rhsa-2023:0449 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-4238 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-github-masterminds-goutils, Ubuntu:24.04:LTS: golang-github-masterminds-goutils, Ubuntu:25.10: golang-github-masterminds-goutils, Ubuntu:26.04:LTS: golang-github-masterminds-goutils</p> <p>Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-github-masterminds-goutils, Ubuntu:24.04:LTS: golang-github-masterminds-goutils, Ubuntu:25.10: golang-github-masterminds-goutils, Ubuntu:26.04:LTS: golang-github-masterminds-goutils</p> <p>Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-4238 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0224 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0224