Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the systems cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID 00000000-0000-0000-0000-000000000000. The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.
Weakness
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Utils | Gofiber | * | 1.2.0 (including) |
| Utils | Gofiber | 2.0.0-beta1 (including) | 2.0.0-beta1 (including) |
| Utils | Gofiber | 2.0.0-beta10 (including) | 2.0.0-beta10 (including) |
| Utils | Gofiber | 2.0.0-beta11 (including) | 2.0.0-beta11 (including) |
| Utils | Gofiber | 2.0.0-beta12 (including) | 2.0.0-beta12 (including) |
| Utils | Gofiber | 2.0.0-beta13 (including) | 2.0.0-beta13 (including) |
| Utils | Gofiber | 2.0.0-beta14 (including) | 2.0.0-beta14 (including) |
| Utils | Gofiber | 2.0.0-beta2 (including) | 2.0.0-beta2 (including) |
| Utils | Gofiber | 2.0.0-beta3 (including) | 2.0.0-beta3 (including) |
| Utils | Gofiber | 2.0.0-beta4 (including) | 2.0.0-beta4 (including) |
| Utils | Gofiber | 2.0.0-beta5 (including) | 2.0.0-beta5 (including) |
| Utils | Gofiber | 2.0.0-beta6 (including) | 2.0.0-beta6 (including) |
| Utils | Gofiber | 2.0.0-beta7 (including) | 2.0.0-beta7 (including) |
| Utils | Gofiber | 2.0.0-beta8 (including) | 2.0.0-beta8 (including) |
| Utils | Gofiber | 2.0.0-beta9 (including) | 2.0.0-beta9 (including) |
| Utils | Gofiber | 2.0.0-rc1 (including) | 2.0.0-rc1 (including) |
| Utils | Gofiber | 2.0.0-rc2 (including) | 2.0.0-rc2 (including) |
| Utils | Gofiber | 2.0.0-rc3 (including) | 2.0.0-rc3 (including) |
| Utils | Gofiber | 2.0.0-rc4 (including) | 2.0.0-rc4 (including) |