Insufficient randomness in github.com/Masterminds/goutils
Priority MEDIUM 50CWE-331Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Partial Red Hat: 12 fixed, 12 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01408 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/Masterminds/goutils (github.com/Masterminds/goutils): 1.1.1github.com/Masterminds/goutils (Go): 1.1.1Red Hat: 23 advisoriesRed Hat: 12 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| github.com/Masterminds/goutils | github.com/Masterminds/goutils | before 1.1.1 | 1.1.1 | Patch available | CNA |
| — | github.com/Masterminds/goutils (Go) | before 1.1.1 | 1.1.1 | Patch available | GHSA-xg2h-wx96-xgxr |
- github.com/Masterminds/goutils Vendorgithub.com/Masterminds/goutils Affected before 1.1.1 Fixed in 1.1.1 Patch available CNA
- github.com/Masterminds/goutils (Go) Vendor— Affected before 1.1.1 Fixed in 1.1.1 Patch available GHSA-xg2h-wx96-xgxr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:goutils_project:goutils:*:*:*:*:*:go:*:* | before 1.1.1 | Vulnerable | Goutils Project |
- cpe:2.3:a:goutils_project:goutils:*:*:*:*:*:go:*:* Versions before 1.1.1 Vulnerable ·Goutils Project
Remediation
- Fix · CNA github.com/Masterminds/goutils (github.com/Masterminds/goutils) Fixed in 1.1.1
- Fix · GHSA-xg2h-wx96-xgxr github.com/Masterminds/goutils (Go) Fixed in 1.1.1 Advisory →
Red Hat 23 advisories
- RHSA-2023:3742 Released 2023-06-21 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.13.0 security and bug fix update
- RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
- RHSA-2023:1326 Released 2023-05-17 · Red Hat rating ImportantOpenShift Container Platform 4.13.0 security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2023:1393 Released 2023-03-29 · Red Hat rating ImportantOpenShift Container Platform 4.10.55 security update
- Red Hat OpenShift Container Platform 4.10 openshift4/ose-kubernetes-nmstate-handler-rhel8
Show 20 more Red Hat advisories
- RHSA-2023:1297 Released 2023-03-22 · Red Hat rating ImportantOpenShift Container Platform 4.11.32 security and extras update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-kubernetes-nmstate-handler-rhel8
- RHSA-2023:1270 Released 2023-03-21 · Red Hat rating ImportantOpenShift Container Platform 4.12.8 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-kubernetes-nmstate-handler-rhel8
- RHSA-2023:1154 Released 2023-03-16 · Red Hat rating ImportantOpenShift Container Platform 4.10.54 security update
- Red Hat OpenShift Container Platform 4.10 openshift4/ose-csi-driver-manila-rhel8-operator, openshift4/ose-machine-config-operator
- RHSA-2023:1159 Released 2023-03-14 · Red Hat rating ImportantOpenShift Container Platform 4.11.31 security and extras update
- Red Hat OpenShift Container Platform 4.11 openshift4/dpu-network-rhel8-operator
- RHSA-2023:1170 Released 2023-03-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.12.1 security bug fix update
- RHODF 4.12 for RHEL 8 odf4/mcg-rhel8-operator
- RHSA-2023:0899 Released 2023-03-01 · Red Hat rating ImportantOpenShift Container Platform 4.10.53 bug fix and security update
- Red Hat OpenShift Container Platform 4.10 openshift4/ose-csi-driver-manila-rhel8, openshift4/ose-installer, openshift4/ose-openstack-machine-controllers +1
- RHSA-2023:0774 Released 2023-02-21 · Red Hat rating ImportantOpenShift Container Platform 4.11.28 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-csi-driver-manila-rhel8, openshift4/ose-installer, openshift4/ose-installer-artifacts +1
- RHSA-2023:0770 Released 2023-02-20 · Red Hat rating ImportantOpenShift Container Platform 4.12.4 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/dpu-network-rhel8-operator
- RHSA-2023:0804 Released 2023-02-17 · Red Hat rating ImportantRed Hat OpenShift GitOps security update
- Red Hat OpenShift GitOps 1.5 openshift-gitops-1/applicationset-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/dex-rhel8 +2
- RHSA-2023:0803 Released 2023-02-17 · Red Hat rating ImportantRed Hat OpenShift GitOps security update
- Red Hat OpenShift GitOps 1.7 openshift-gitops-1/argocd-rhel8, openshift-gitops-1/dex-rhel8, openshift-gitops-1/gitops-rhel8-operator +1
- RHSA-2023:0802 Released 2023-02-17 · Red Hat rating ImportantRed Hat OpenShift GitOps security update
- Red Hat OpenShift GitOps 1.6 openshift-gitops-1/argocd-rhel8, openshift-gitops-1/dex-rhel8, openshift-gitops-1/gitops-rhel8-operator +1
- RHSA-2023:0728 Released 2023-02-16 · Red Hat rating ImportantOpenShift Container Platform 4.12.3 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-cluster-etcd-rhel8-operator, openshift4/ose-csi-driver-manila-rhel8, openshift4/ose-installer
- RHSA-2023:0651 Released 2023-02-15 · Red Hat rating ImportantOpenShift Container Platform 4.11.27 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-machine-config-operator
- RHSA-2023:0574 Released 2023-02-13 · Red Hat rating CriticalOpenShift Container Platform 4.9.55 security update
- Red Hat OpenShift Container Platform 4.9 openshift4/ose-cluster-network-operator, openshift4/ose-etcd, openshift4/ose-grafana
- RHSA-2023:0561 Released 2023-02-08 · Red Hat rating ImportantOpenShift Container Platform 4.10.51 security update
- Red Hat OpenShift Container Platform 4.10 openshift4/ose-cluster-network-operator
- RHSA-2023:0569 Released 2023-02-07 · Red Hat rating ImportantOpenShift Container Platform 4.12.2 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-installer, openshift4/ose-machine-config-operator
- RHSA-2023:0565 Released 2023-02-07 · Red Hat rating ImportantOpenShift Container Platform 4.11.26 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-cluster-baremetal-operator-rhel8, openshift4/ose-image-customization-controller-rhel8
- RHSA-2023:0449 Released 2023-01-30 · Red Hat rating ImportantOpenShift Container Platform 4.12.1 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-image-customization-controller-rhel8
- RHSA-2023:0542 Released 2023-01-30 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.3.1 Containers security update
- RHOSSM 2.3 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/kiali-rhel8 +4
- RHSA-2023:0540 Released 2023-01-30 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.1.6 security update
- OpenShift Service Mesh 2.1 servicemesh-2.1.6-1.el8, servicemesh-cni-2.1.6-1.el8, servicemesh-operator-2.1.6-1.el8 +2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Fixed | RHSA-2023:0540 |
| RHODF 4.12 for RHEL 8 | Fixed | RHSA-2023:1170 |
| RHODF 4.13 for RHEL 9 | Fixed | RHSA-2023:3742 |
| RHOSSM 2.3 for RHEL 8 | Fixed | RHSA-2023:0542 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2023:0561, RHSA-2023:0899, RHSA-2023:1154, RHSA-2023:1393 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2023:0565, RHSA-2023:0651, RHSA-2023:0774, RHSA-2023:1159, RHSA-2023:1297 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2023:0449, RHSA-2023:0569, RHSA-2023:0728, RHSA-2023:0770, RHSA-2023:1270 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:1326 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2023:0574 |
| Red Hat OpenShift GitOps 1.5 | Fixed | RHSA-2023:0804 |
| Red Hat OpenShift GitOps 1.6 | Fixed | RHSA-2023:0802 |
| Red Hat OpenShift GitOps 1.7 | Fixed | RHSA-2023:0803 |
Not affected: 24 products
- Cryostat 2
- Logging Subsystem for Red Hat OpenShift
- OpenShift Service Mesh 2
- OpenShift Service Mesh 2.1
- RHODF 4.12 for RHEL 8
- RHODF 4.13 for RHEL 9
- RHOSSM 2.3 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 3
- Red Hat Ansible Automation Platform 1.2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.9
- Red Hat OpenShift GitOps 1.5
- Red Hat OpenShift GitOps 1.6
- Red Hat OpenShift GitOps 1.7
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Container Storage 4
- Red Hat Openshift Data Foundation 4
- Self Node Remediation Operator
- cert-manager Operator for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2021-4238
- 2026-10-03 Alias added: GHSA-xg2h-wx96-xgxr
References
Exploit 1
Sources
- CVE-2021-4238 · CVE Program
- CVE-2021-4238 · NVD
- FIRST EPSS
- GHSA-xg2h-wx96-xgxr · GitHub Advisory Database · CC BY 4.0
- CVE-2021-4238 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences