From 0d8393ddcf83b1c38549cafaf0042c9d098dd7ad Mon Sep 17 00:00:00 2001 From: Garrison Davis Date: Tue, 6 Sep 2022 13:52:13 -0600 Subject: [PATCH] Fix UUID library version for CVE-2021-3538 (#2213) We were using v1.2.0 of the github.com/satori/go.uuid library to generate UUIDs for transactions if the transaction had no previous id. That version of the library had CVE-2021-3538: "Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker." More reading can be done here: https://pkg.go.dev/vuln/GO-2022-0244 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3538 This vulnerability was found using the new govulncheck tool which is not currently used in our CI pipeline but might be a good candidate to include in the future. (Like all tools like this there are caveats to its usage and utility which can be read about below.) Information on that tool can be found here: https://go.dev/blog/vuln https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck --- go.mod | 2 +- go.sum | 4 +++- server.go | 6 +++++- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index be55e715b..ea67c1be5 100644 --- a/go.mod +++ b/go.mod @@ -48,7 +48,7 @@ require ( github.com/rakyll/statik v0.1.7 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect github.com/ricochet2200/go-disk-usage/du v0.0.0-20210707232629-ac9918953285 - github.com/satori/go.uuid v1.2.0 + github.com/satori/go.uuid v1.2.1-0.20180404165556-75cca531ea76 github.com/segmentio/kafka-go v0.4.29 github.com/shirou/gopsutil/v3 v3.22.5 github.com/spf13/cobra v1.2.1 diff --git a/go.sum b/go.sum index 7dc6b3174..a7089611e 100644 --- a/go.sum +++ b/go.sum @@ -932,8 +932,10 @@ github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFo github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E= github.com/santhosh-tekuri/jsonschema/v5 v5.0.0/go.mod h1:FKdcjfQW6rpZSnxxUvEA5H/cDPdvJ/SZJQLWWXWGrZ0= -github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww= github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0= +github.com/satori/go.uuid v1.2.1-0.20180404165556-75cca531ea76 h1:ofyVTM1w4iyKwaQIlRR6Ip06mXXx5Cnz7a4mTGYq1hE= +github.com/satori/go.uuid v1.2.1-0.20180404165556-75cca531ea76/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0= +github.com/schollz/closestmatch v2.1.0+incompatible/go.mod h1:RtP1ddjLong6gTkbtmuhtR2uUrrJOpYzYRvbcPAid+g= github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc= github.com/segmentio/kafka-go v0.4.29 h1:4ujULpikzHG0HqKhjumDghFjy/0RRCSl/7lbriwQAH0= github.com/segmentio/kafka-go v0.4.29/go.mod h1:m1lXeqJtIFYZayv0shM/tjrAFljvWLTprxBHd+3PnaU= diff --git a/server.go b/server.go index 80bb2131f..7213a8f8b 100644 --- a/server.go +++ b/server.go @@ -1320,7 +1320,11 @@ func (srv *Server) StartTransaction(ctx context.Context, id string, timeout time // empty string id should generate an id if id == "" { - id = uuid.NewV4().String() + uid, err := uuid.NewV4() + if err != nil { + return nil, errors.Wrap(err, "creating id") + } + id = uid.String() } trns, err := srv.holder.StartTransaction(ctx, id, timeout, exclusive) if err != nil {