CVE-2015-8851: Insufficient Entropy (CWE-331)
value: node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.
CWE description: The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
CVSS v3 base score: 7.5
Published: 2020-01-30T21:15Z
Repository: https://github.com/broofa/node-uuid
Language: JavaScript
Files changed: package.json, test/test.js, uuid.js
Commit date: 2015-11-11 17:29:04 -0800
Commit message: v1.4.4: close #122 #118 #108

Diff: diff --git a/package.json b/package.json
index 73df8a7..caf692f 100644
--- a/package.json
+++ b/package.json
@@ -1,24 +1,61 @@
 {
-  "name"          : "node-uuid",
-  "description"   : "Rigorous implementation of RFC4122 (v1 and v4) UUIDs.",
-  "url"           : "http://github.com/broofa/node-uuid",
-  "keywords"      : ["uuid", "guid", "rfc4122"],
-  "author"        : "Robert Kieffer <robert@broofa.com>",
-  "contributors"  : [
-    {"name": "Christoph Tavan <dev@tavan.de>", "github": "https://github.com/ctavan"}
-  ],
+  "author": {
+    "email": "robert@broofa.com",
+    "name": "Robert Kieffer"
+  },
   "bin": {
     "uuid": "./bin/uuid"
   },
+  "bugs": {
+    "url": "https://github.com/broofa/node-uuid/issues"
+  },
+  "contributors": [
+    {
+      "name": "AJ ONeal",
+      "email": "coolaj86@gmail.com"
+    },
+    {
+      "name": "Christoph Tavan",
+      "email": "dev@tavan.de"
+    }
+  ],
+  "dependencies": {},
+  "description": "Rigorous implementation of RFC4122 (v1 and v4) UUIDs.",
+  "devDependencies": {
+    "nyc": "^2.2.0"
+  },
+  "directories": {},
+  "homepage": "https://github.com/broofa/node-uuid",
+  "installable": true,
+  "keywords": [
+    "guid",
+    "rfc4122",
+    "uuid"
+  ],
+  "lib": ".",
+  "licenses": [
+    {
+      "type": "MIT",
+      "url": "https://raw.github.com/broofa/node-uuid/master/LICENSE.md"
+    }
+  ],
+  "main": "./uuid.js",
+  "maintainers": [
+    {
+      "name": "broofa",
+      "email": "robert@broofa.com"
+    }
+  ],
+  "name": "node-uuid",
+  "optionalDependencies": {},
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/broofa/node-uuid.git"
+  },
   "scripts": {
-    "test": "node test/test.js",
-    "coverage": "nyc npm test && nyc report"
+    "coverage": "nyc npm test && nyc report",
+    "test": "node test/test.js"
   },
-  "lib"           : ".",
-  "main"          : "./uuid.js",
-  "repository"    : { "type" : "git", "url" : "https://github.com/broofa/node-uuid.git" },
-  "version"       : "1.4.2",
-  "license"       : "MIT",
-  "devDependencies": { "nyc": "^2.2.0" }
-
+  "url": "http://github.com/broofa/node-uuid",
+  "version": "1.4.4"
 }
diff --git a/test/test.js b/test/test.js
index 2469225..5f1113d 100644
--- a/test/test.js
+++ b/test/test.js
@@ -1,8 +1,11 @@
 if (!this.uuid) {
   // node.js
   uuid = require('../uuid');
+  if (!/_rb/.test(uuid._rng.toString())) {
+    throw new Error("should use crypto for node.js");
+  }
 }
 
 //
 // x-platform log/assert shims
 //
diff --git a/uuid.js b/uuid.js
index 8c1a26b..020a77a 100644
--- a/uuid.js
+++ b/uuid.js
@@ -17,11 +17,11 @@
   // Node.js crypto-based RNG - http://nodejs.org/docs/v0.6.2/api/crypto.html
   //
   // Moderately fast, high quality
   if ('function' === typeof require) {
     try {
-      var _rb = _global.require('crypto').randomBytes;
+      var _rb = require('crypto').randomBytes;
       _rng = _rb && function() {return _rb(16);};
     } catch(e) {}
   }
 
   if (!_rng && _crypto && _crypto.getRandomValues) {
@@ -224,18 +224,19 @@
   uuid.v1 = v1;
   uuid.v4 = v4;
   uuid.parse = parse;
   uuid.unparse = unparse;
   uuid.BufferClass = BufferClass;
+  uuid._rng = _rng;
 
   if (typeof(module) != 'undefined' && module.exports) {
     // Publish as node.js module
     module.exports = uuid;
   } else  if (typeof define === 'function' && define.amd) {
     // Publish as AMD module
     define(function() {return uuid;});
- 
+
 
   } else {
     // Publish as global (in browsers)
     var _previousRoot = _global.uuid;
 

Vulnerable code:   "name"          : "node-uuid",
  "description"   : "Rigorous implementation of RFC4122 (v1 and v4) UUIDs.",
  "url"           : "http://github.com/broofa/node-uuid",
  "keywords"      : ["uuid", "guid", "rfc4122"],
  "author"        : "Robert Kieffer <robert@broofa.com>",
  "contributors"  : [
    {"name": "Christoph Tavan <dev@tavan.de>", "github": "https://github.com/ctavan"}
  ],
    "test": "node test/test.js",
    "coverage": "nyc npm test && nyc report"
  "lib"           : ".",
  "main"          : "./uuid.js",
  "repository"    : { "type" : "git", "url" : "https://github.com/broofa/node-uuid.git" },
  "version"       : "1.4.2",
  "license"       : "MIT",
  "devDependencies": { "nyc": "^2.2.0" }

      var _rb = _global.require('crypto').randomBytes;
 
Fixed code:   "author": {
    "email": "robert@broofa.com",
    "name": "Robert Kieffer"
  },
  "bugs": {
    "url": "https://github.com/broofa/node-uuid/issues"
  },
  "contributors": [
    {
      "name": "AJ ONeal",
      "email": "coolaj86@gmail.com"
    },
    {
      "name": "Christoph Tavan",
      "email": "dev@tavan.de"
    }
  ],
  "dependencies": {},
  "description": "Rigorous implementation of RFC4122 (v1 and v4) UUIDs.",
  "devDependencies": {
    "nyc": "^2.2.0"
  },
  "directories": {},
  "homepage": "https://github.com/broofa/node-uuid",
  "installable": true,
  "keywords": [
    "guid",
    "rfc4122",
    "uuid"
  ],
  "lib": ".",
  "licenses": [
    {
      "type": "MIT",
      "url": "https://raw.github.com/broofa/node-uuid/master/LICENSE.md"
    }
  ],
  "main": "./uuid.js",
  "maintainers": [
    {
      "name": "broofa",
      "email": "robert@broofa.com"
    }
  ],
  "name": "node-uuid",
  "optionalDependencies": {},
  "repository": {
    "type": "git",
    "url": "https://github.com/broofa/node-uuid.git"
  },
    "coverage": "nyc npm test && nyc report",
    "test": "node test/test.js"
  "url": "http://github.com/broofa/node-uuid",
  "version": "1.4.4"
  if (!/_rb/.test(uuid._rng.toString())) {
    throw new Error("should use crypto for node.js");
  }
      var _rb = require('crypto').randomBytes;
  uuid._rng = _rng;