From 1469f4a72c80fc6e8ba76b4aa92b95dba8c0cc6e Mon Sep 17 00:00:00 2001
From: Garrison Davis <garrison.davis@molecula.com>
Date: Tue, 6 Sep 2022 13:52:13 -0600
Subject: [PATCH] Fix UUID library version for CVE-2021-3538 (#2213)

We were using v1.2.0 of the github.com/satori/go.uuid library to
generate UUIDs for transactions if the transaction had no previous id.

That version of the library had CVE-2021-3538: "Due to insecure
randomness in the g.rand.Read function the generated UUIDs are
predictable for an attacker."

More reading can be done here:
https://pkg.go.dev/vuln/GO-2022-0244
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3538

This vulnerability was found using the new govulncheck tool which is not
currently used in our CI pipeline but might be a good candidate to
include in the future. (Like all tools like this there are caveats to
its usage and utility which can be read about below.)

Information on that tool can be found here:
https://go.dev/blog/vuln
https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
---
 go.mod    | 2 +-
 go.sum    | 3 ++-
 server.go | 6 +++++-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 0521d7e2e..91ff1cd69 100644
--- a/go.mod
+++ b/go.mod
@@ -48,7 +48,7 @@ require (
 	github.com/rakyll/statik v0.1.7
 	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
 	github.com/ricochet2200/go-disk-usage/du v0.0.0-20210707232629-ac9918953285
-	github.com/satori/go.uuid v1.2.0
+	github.com/satori/go.uuid v1.2.1-0.20180404165556-75cca531ea76
 	github.com/segmentio/kafka-go v0.4.29
 	github.com/shirou/gopsutil/v3 v3.22.5
 	github.com/spf13/cobra v1.2.1
diff --git a/go.sum b/go.sum
index 5aca17ea4..b2d90ac34 100644
--- a/go.sum
+++ b/go.sum
@@ -979,8 +979,9 @@ github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFo
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
 github.com/santhosh-tekuri/jsonschema/v5 v5.0.0/go.mod h1:FKdcjfQW6rpZSnxxUvEA5H/cDPdvJ/SZJQLWWXWGrZ0=
-github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
+github.com/satori/go.uuid v1.2.1-0.20180404165556-75cca531ea76 h1:ofyVTM1w4iyKwaQIlRR6Ip06mXXx5Cnz7a4mTGYq1hE=
+github.com/satori/go.uuid v1.2.1-0.20180404165556-75cca531ea76/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/schollz/closestmatch v2.1.0+incompatible/go.mod h1:RtP1ddjLong6gTkbtmuhtR2uUrrJOpYzYRvbcPAid+g=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/segmentio/kafka-go v0.4.29 h1:4ujULpikzHG0HqKhjumDghFjy/0RRCSl/7lbriwQAH0=
diff --git a/server.go b/server.go
index b5c1a15d1..fe53c98bd 100644
--- a/server.go
+++ b/server.go
@@ -1319,7 +1319,11 @@ func (srv *Server) StartTransaction(ctx context.Context, id string, timeout time
 
 	// empty string id should generate an id
 	if id == "" {
-		id = uuid.NewV4().String()
+		uid, err := uuid.NewV4()
+		if err != nil {
+			return nil, errors.Wrap(err, "creating id")
+		}
+		id = uid.String()
 	}
 	trns, err := srv.holder.StartTransaction(ctx, id, timeout, exclusive)
 	if err != nil {