CVE Vulnerabilities

CVE-2015-8851

Insufficient Entropy

Published: Jan 30, 2020 | Modified: Feb 05, 2020
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
4.3 MODERATE
AV:A/AC:M/Au:N/C:P/I:P/A:N
RedHat/V3
Ubuntu
MEDIUM

node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.

Weakness

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Affected Software

Name Vendor Start Version End Version
Node-uuid Node-uuid_project * 1.4.4 (excluding)
Red Hat OpenShift Container Platform 3.2 RedHat atomic-openshift-0:3.2.1.1-1.git.0.96f9555.el7 *
Red Hat OpenShift Container Platform 3.2 RedHat heapster-0:1.1.0-1.beta2.el7 *
Node-uuid Ubuntu artful *
Node-uuid Ubuntu precise *
Node-uuid Ubuntu upstream *
Node-uuid Ubuntu wily *
Node-uuid Ubuntu yakkety *
Node-uuid Ubuntu zesty *

Potential Mitigations

References