CVE Vulnerabilities

CVE-2021-4238

Insufficient Entropy

Published: Dec 27, 2022 | Modified: Jan 05, 2023
CVSS 3.x
9.1
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
7 IMPORTANT
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Ubuntu
MEDIUM

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.

Weakness

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Affected Software

Name Vendor Start Version End Version
Goutils Goutils_project * 1.1.1 (excluding)
OpenShift Service Mesh 2.1 RedHat servicemesh-0:2.1.6-1.el8 *
OpenShift Service Mesh 2.1 RedHat servicemesh-operator-0:2.1.6-1.el8 *
Red Hat OpenShift Container Platform 4.10 RedHat openshift4/ose-cluster-network-operator:v4.10.0-202301310115.p0.gdc0a59a.assembly.stream *
Red Hat OpenShift Container Platform 4.10 RedHat openshift4/ose-installer:v4.10.0-202302161028.p0.g8862860.assembly.stream *
Red Hat OpenShift Container Platform 4.10 RedHat openshift4/ose-machine-config-operator:v4.10.0-202303032215.p0.ga21b2b8.assembly.stream *
Red Hat OpenShift Container Platform 4.10 RedHat openshift4/ose-kubernetes-nmstate-handler-rhel8:v4.10.0-202303162241.p0.g68b1665.assembly.stream *
Red Hat OpenShift Container Platform 4.11 RedHat openshift4/ose-cluster-baremetal-operator-rhel8:v4.11.0-202301191245.p0.g4ffdd2f.assembly.stream *
Red Hat OpenShift Container Platform 4.11 RedHat openshift4/ose-image-customization-controller-rhel8:v4.11.0-202301252336.p0.ge0e3979.assembly.stream *
Red Hat OpenShift Container Platform 4.11 RedHat openshift4/ose-machine-config-operator:v4.11.0-202302071115.p0.gc101063.assembly.stream *
Red Hat OpenShift Container Platform 4.11 RedHat openshift4/ose-installer:v4.11.0-202302130454.p0.g59d1196.assembly.stream *
Red Hat OpenShift Container Platform 4.11 RedHat openshift4/dpu-network-rhel8-operator:v4.11.0-202302282354.p0.g7183b08.assembly.stream *
Red Hat OpenShift Container Platform 4.11 RedHat openshift4/ose-kubernetes-nmstate-handler-rhel8:v4.11.0-202303151654.p0.g4695e71.assembly.stream *
Red Hat OpenShift Container Platform 4.12 RedHat openshift4/ose-image-customization-controller-rhel8:v4.12.0-202301171655.p0.g27777d0.assembly.stream *
Red Hat OpenShift Container Platform 4.12 RedHat openshift4/ose-machine-config-operator:v4.12.0-202301262025.p0.ge3dc943.assembly.stream *
Red Hat OpenShift Container Platform 4.12 RedHat openshift4/ose-installer:v4.12.0-202302080355.p0.gb8d2457.assembly.stream *
Red Hat OpenShift Container Platform 4.12 RedHat openshift4/dpu-network-rhel8-operator:v4.12.0-202302111028.p0.gb6124a7.assembly.stream *
Red Hat OpenShift Container Platform 4.12 RedHat openshift4/ose-kubernetes-nmstate-handler-rhel8:v4.12.0-202303081941.p0.gc56075a.assembly.stream *
Red Hat OpenShift Container Platform 4.13 RedHat openshift4/ose-image-customization-controller-rhel8:v4.13.0-202304260928.p0.g8765166.assembly.stream *
Red Hat OpenShift Container Platform 4.13 RedHat openshift4/ose-installer:v4.13.0-202305091542.p0.g44db7b2.assembly.stream *
Red Hat OpenShift Container Platform 4.13 RedHat openshift4/ose-machine-config-operator:v4.13.0-202304251516.p0.g70aa0a5.assembly.stream *
Red Hat OpenShift Container Platform 4.9 RedHat openshift4/ose-cluster-network-operator:v4.9.0-202301301454.p0.gbb98961.assembly.stream *
Red Hat OpenShift GitOps 1.5 RedHat openshift-gitops-1/applicationset-rhel8:v1.5.10-6 *
Red Hat OpenShift GitOps 1.5 RedHat openshift-gitops-1/argocd-rhel8:v1.5.10-6 *
Red Hat OpenShift GitOps 1.5 RedHat openshift-gitops-1/dex-rhel8:v1.5.10-6 *
Red Hat OpenShift GitOps 1.5 RedHat openshift-gitops-1/gitops-rhel8-operator:v1.5.10-6 *
Red Hat OpenShift GitOps 1.5 RedHat openshift-gitops-1/kam-delivery-rhel8:v1.5.10-6 *
Red Hat OpenShift GitOps 1.6 RedHat openshift-gitops-1/argocd-rhel8:v1.6.5-5 *
Red Hat OpenShift GitOps 1.6 RedHat openshift-gitops-1/dex-rhel8:v1.6.5-5 *
Red Hat OpenShift GitOps 1.6 RedHat openshift-gitops-1/gitops-rhel8-operator:v1.6.5-5 *
Red Hat OpenShift GitOps 1.6 RedHat openshift-gitops-1/kam-delivery-rhel8:v1.6.5-5 *
Red Hat OpenShift GitOps 1.7 RedHat openshift-gitops-1/argocd-rhel8:v1.7.2-5 *
Red Hat OpenShift GitOps 1.7 RedHat openshift-gitops-1/dex-rhel8:v1.7.2-5 *
Red Hat OpenShift GitOps 1.7 RedHat openshift-gitops-1/gitops-rhel8-operator:v1.7.2-5 *
Red Hat OpenShift GitOps 1.7 RedHat openshift-gitops-1/kam-delivery-rhel8:v1.7.2-5 *
Red Hat OpenShift Service Mesh 2.3 for RHEL 8 RedHat openshift-service-mesh/istio-rhel8-operator:2.3.1-10 *
RHODF-4.12-RHEL-8 RedHat odf4/mcg-rhel8-operator:v4.12.1-4 *
RHODF-4.13-RHEL-9 RedHat odf4/mcg-rhel9-operator:v4.13.0-41 *
Golang-github-masterminds-goutils Ubuntu kinetic *
Golang-github-masterminds-goutils Ubuntu lunar *
Golang-github-masterminds-goutils Ubuntu mantic *
Golang-github-masterminds-goutils Ubuntu trusty *
Golang-github-masterminds-goutils Ubuntu xenial *

Potential Mitigations

References