Skip to content
Fencer Vulns
critical 9.1

CVE-2021-4238 json

Insufficient randomness in github.com/Masterminds/goutils

published 2021-05-21 5 y ago modified 2026-09-10 1 mo ago also GHSA-3839-6r69-m497 , GHSA-xg2h-wx96-xgxr , GO-2022-0411 , EUVD-2022-7482

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.

Patch / fix

  • go github.com/Masterminds/goutils 1.1.1
  • github.com/Masterminds/goutils github.com/Masterminds/goutils 1.1.1
  • servicemesh service mesh 2.1 2.1.6-1.el8
  • servicemesh-cni service mesh 2.1 2.1.6-1.el8
  • servicemesh-operator service mesh 2.1 2.1.6-1.el8
  • servicemesh-pilot-agent service mesh 2.1 2.1.6-1.el8
  • servicemesh-pilot-discovery service mesh 2.1 2.1.6-1.el8

red hat advisories RHSA-2023:0540

  • influxdb Azure Linux 3.0 2.7.3-3

azure linux advisories AZL-41275

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-4238 updated cvss 7.0

goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be

  • Red Hat OpenShift Developer Tools and Services helm, jenkins-operator-container
    affected: no fix available
  • Red Hat OpenShift Serverless openshift-gitops-1/gitops-rhel8-operator, openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-1/kn-serving-queue-rhel9, openshift-serverless-1/kn-plugin-event-sender-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator Red Hat OpenShift Container Platform 4 openshift4/ose-ptp, openshift4/ose-ptp-operator, openshift4/ztp-site-generate-rhel8, openshift-compliance-openscap-container, openshift4/ose-metering-ansible-operator, openshift4/ose-metering-helm-container-rhel8, +1 more Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8, rhai-tech-preview/assisted-installer-agent-rhel8 Red Hat Openshift Container Storage 4 ocs4/mcg-rhel8-operator Red Hat Openshift Data Foundation 4 odf4/odf-rhel8-operator, odf4/odf-multicluster-rhel9-operator Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8
    +4 more products
    Red Hat OpenShift GitOps openshift-gitops-1/gitops-rhel8-operator Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/kubernetes-nmstate-handler-rhel8 Red Hat Quay 3 quay/quay-openshift-bridge-rhel8-operator
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2.1 servicemesh 2.1.6-1.el8, servicemesh-cni 2.1.6-1.el8, servicemesh-operator 2.1.6-1.el8, servicemesh-pilot-agent 2.1.6-1.el8, servicemesh-pilot-discovery 2.1.6-1.el8
    fixed: vendor fix RHSA-2023:0540
  • Red Hat OpenShift Container Platform 4.9 openshift4/ose-cluster-network-operator v4.9.0-202301301454.p0.gbb98961.assembly.stream
    fixed: vendor fix RHSA-2023:0574
  • Red Hat OpenShift Container Platform 4.10 openshift4/ose-installer v4.10.0-202302161028.p0.g8862860.assembly.stream, openshift4/ose-machine-config-operator v4.10.0-202303032215.p0.ga21b2b8.assembly.stream, openshift4/ose-cluster-network-operator v4.10.0-202301310115.p0.gdc0a59a.assembly.stream, openshift4/ose-kubernetes-nmstate-handler-rhel8 v4.10.0-202303162241.p0.g68b1665.assembly.stream
    fixed: vendor fix RHSA-2023:0561
  • Red Hat OpenShift Container Platform 4.11 openshift4/ose-installer v4.11.0-202302130454.p0.g59d1196.assembly.stream, openshift4/dpu-network-rhel8-operator v4.11.0-202302282354.p0.g7183b08.assembly.stream, openshift4/ose-machine-config-operator v4.11.0-202302071115.p0.gc101063.assembly.stream, openshift4/ose-cluster-baremetal-operator-rhel8 v4.11.0-202301191245.p0.g4ffdd2f.assembly.stream, openshift4/ose-kubernetes-nmstate-handler-rhel8 v4.11.0-202303151654.p0.g4695e71.assembly.stream, openshift4/ose-image-customization-controller-rhel8 v4.11.0-202301252336.p0.ge0e3979.assembly.stream
    fixed: vendor fix RHSA-2023:1159
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-installer v4.12.0-202302080355.p0.gb8d2457.assembly.stream, openshift4/dpu-network-rhel8-operator v4.12.0-202302111028.p0.gb6124a7.assembly.stream, openshift4/ose-machine-config-operator v4.12.0-202301262025.p0.ge3dc943.assembly.stream, openshift4/ose-kubernetes-nmstate-handler-rhel8 v4.12.0-202303081941.p0.gc56075a.assembly.stream, openshift4/ose-image-customization-controller-rhel8 v4.12.0-202301171655.p0.g27777d0.assembly.stream
    fixed: vendor fix RHSA-2023:0770
show 8 more
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-installer v4.13.0-202305091542.p0.g44db7b2.assembly.stream, openshift4/ose-machine-config-operator v4.13.0-202304251516.p0.g70aa0a5.assembly.stream, openshift4/ose-image-customization-controller-rhel8 v4.13.0-202304260928.p0.g8765166.assembly.stream
    fixed: vendor fix RHSA-2023:1326
  • Red Hat OpenShift GitOps 1.5 openshift-gitops-1/dex-rhel8 v1.5.10-6, openshift-gitops-1/argocd-rhel8 v1.5.10-6, openshift-gitops-1/kam-delivery-rhel8 v1.5.10-6, openshift-gitops-1/applicationset-rhel8 v1.5.10-6, openshift-gitops-1/gitops-rhel8-operator v1.5.10-6
    fixed: vendor fix RHSA-2023:0804
  • Red Hat OpenShift GitOps 1.6 openshift-gitops-1/dex-rhel8 v1.6.5-5, openshift-gitops-1/argocd-rhel8 v1.6.5-5, openshift-gitops-1/kam-delivery-rhel8 v1.6.5-5, openshift-gitops-1/gitops-rhel8-operator v1.6.5-5
    fixed: vendor fix RHSA-2023:0802
  • Red Hat OpenShift GitOps 1.7 openshift-gitops-1/dex-rhel8 v1.7.2-5, openshift-gitops-1/argocd-rhel8 v1.7.2-5, openshift-gitops-1/kam-delivery-rhel8 v1.7.2-5, openshift-gitops-1/gitops-rhel8-operator v1.7.2-5
    fixed: vendor fix RHSA-2023:0803
  • Red Hat RHODF 4.12 for RHEL 8 odf4/mcg-rhel8-operator v4.12.1-4
    fixed: vendor fix RHSA-2023:1170
  • Red Hat RHODF 4.13 for RHEL 9 odf4/mcg-rhel9-operator v4.13.0-41
    fixed: vendor fix RHSA-2023:3742
  • Red Hat RHOSSM 2.3 for RHEL 8 openshift-service-mesh/istio-rhel8-operator 2.3.1-10
    fixed: vendor fix RHSA-2023:0542
  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/jetstack-cert-manager-rhel9 Red Hat Cryostat 2 cryostat/cryostat-rhel8-operator Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/lokistack-gateway-rhel8 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-cni-rhel8 Red Hat OpenShift Service Mesh 2.1 servicemesh-proxy 2.1.6-1.el8, servicemesh-ratelimit 2.1.6-1.el8, servicemesh-proxy-wasm 2.1.6-1.el8, servicemesh-prometheus 2.23.0-10.el8 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/search-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/multiclusterhub-rhel8, rhacm2/rbac-query-proxy-rhel8, rhacm2/search-collector-rhel9, rhacm2/acm-cluster-proxy-rhel8, +18 more
    +10 more products
    Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat Ansible Automation Platform 1.2 helm Red Hat OpenShift Container Platform 4 poison-pill-container, openshift4/ose-console, openshift4/ose-grafana, openshift4/cnf-tests-rhel8, redhat/redhat-operator-index, openshift4/ose-docker-builder, +32 more Red Hat OpenShift Container Platform 4.9 openshift4/ose-cli v4.9.0-202301301454.p0.g88cfeb4.assembly.stream, openshift4/ose-pod v4.9.0-202301301454.p0.gc763d11.assembly.stream, openshift4/ose-etcd v4.9.0-202301301454.p0.g9aaa8c6.assembly.stream, openshift4/ose-tests v4.9.0-202301301454.p0.g9830fc9.assembly.stream, openshift4/ose-console v4.9.0-202301301454.p0.g04f9d38.assembly.stream, openshift4/ose-coredns v4.9.0-202301302354.p0.ge332b9e.assembly.stream, +148 more Red Hat OpenShift Container Platform 4.10 openshift4/ose-cli v4.10.0-202301301442.p0.gdaed147.assembly.stream, openshift4/ose-cli v4.10.0-202302280915.p0.gdaed147.assembly.stream, openshift4/ose-pod v4.10.0-202301301442.p0.g8a6bfe4.assembly.stream, openshift4/ose-pod v4.10.0-202302280915.p0.g8a6bfe4.assembly.stream, openshift4/ose-ptp v4.10.0-202303141355.p0.g4b8a4f7.assembly.stream, openshift4/ose-etcd v4.10.0-202301301442.p0.g90081cb.assembly.stream, +374 more Red Hat OpenShift Container Platform 4.11 openshift4/ose-cli v4.11.0-202302061916.p0.g1928ac4.assembly.stream, openshift4/ose-pod v4.11.0-202301232245.p0.g263df15.assembly.stream, openshift4/ose-pod v4.11.0-202302061916.p0.g263df15.assembly.stream, openshift4/ose-pod v4.11.0-202302071554.p0.gdeccab3.assembly.stream, openshift4/ose-ptp v4.11.0-202302271715.p0.gee62031.assembly.stream, openshift4/ose-ptp v4.11.0-202303081241.p0.gee62031.assembly.stream, +318 more Red Hat OpenShift Container Platform 4.12 openshift4/ose-cli v4.12.0-202301311516.p0.gb05f7d4.assembly.stream, openshift4/ose-cli v4.12.0-202302061702.p0.gb05f7d4.assembly.stream, openshift4/ose-pod v4.12.0-202301102025.p0.ga34b9e9.assembly.stream, openshift4/ose-pod v4.12.0-202302061702.p0.ga34b9e9.assembly.stream, openshift4/ose-ptp v4.12.0-202303081116.p0.g79f4296.assembly.stream, openshift4/ose-etcd v4.12.0-202301122126.p0.g978cfef.assembly.stream, +312 more Red Hat OpenShift Container Platform 4.13 openshift4/ose-cli v4.13.0-202304190216.p0.g92b1a3d.assembly.stream, openshift4/ose-pod v4.13.0-202304211155.p0.gb404935.assembly.stream, openshift4/ose-etcd v4.13.0-202304190216.p0.gf70da9d.assembly.stream, openshift4/ose-tests v4.13.0-202305031828.p0.g893ae57.assembly.stream, openshift4/ose-console v4.13.0-202305031828.p0.ga551d28.assembly.stream, openshift4/ose-coredns v4.13.0-202304190216.p0.g5560e4a.assembly.stream, +172 more Red Hat Openshift Container Storage 4 ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator Red Hat Openshift Data Foundation 4 odf4/ocs-rhel9-operator, odf4/odr-rhel9-operator, odf4/odf-lvm-rhel8-operator, odf4/rook-ceph-rhel9-operator, odf4/odf-csi-addons-sidecar-rhel8
    not affected: vulnerable code not present

8 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

1.41% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • pkg.go.dev https://pkg.go.dev/vuln/GO-2022-0411 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/Masterminds/goutils
<1.1.1
1.1.1

Affected products

  • github.com/Masterminds/goutils github.com/Masterminds/goutils

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.