CVE-2015-8851 (published 2020-01-30T21:15Z)

node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-331
cwe_name: Insufficient Entropy
description: The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/broofa/node-uuid
commit_details: repo_url: https://github.com/broofa/node-uuid
author: AJ ONeal
author_date: 2015-11-11 17:29:04-08:00
msg: v1.4.4: close #122 #118 #108
repository: repo_url: https://github.com/broofa/node-uuid
repo_name: broofa/node-uuid
description: This code is now maintained at https://github.com/uuidjs/uuid
repo_language: JavaScript
owner: broofa
file_changes: filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,24 +1,61 @@
 {
-  "name"          : "node-uuid",
-  "description"   : "Rigorous implementation of RFC4122 (v1 and v4) UUIDs.",
-  "url"           : "http://github.com/broofa/node-uuid",
-  "keywords"      : ["uuid", "guid", "rfc4122"],
-  "author"        : "Robert Kieffer <robert@broofa.com>",
-  "contributors"  : [
-    {"name": "Christoph Tavan <dev@tavan.de>", "github": "https://github.com/ctavan"}
-  ],
+  "author": {
+    "email": "robert@broofa.com",
+    "name": "Robert Kieffer"
+  },
   "bin": {
     "uuid": "./bin/uuid"
   },
+  "bugs": {
+    "url": "https://github.com/broofa/node-uuid/issues"
+  },
+  "contributors": [
+    {
+      "name": "AJ ONeal",
+      "email": "coolaj86@gmail.com"
+    },
+    {
+      "name": "Christoph Tavan",
+      "email": "dev@tavan.de"
+    }
+  ],
+  "dependencies": {},
+  "description": "Rigorous implementation of RFC4122 (v1 and v4) UUIDs.",
+  "devDependencies": {
+    "nyc": "^2.2.0"
+  },
+  "directories": {},
+  "homepage": "https://github.com/broofa/node-uuid",
+  "installable": true,
+  "keywords": [
+    "guid",
+    "rfc4122",
+    "uuid"
+  ],
+  "lib": ".",
+  "licenses": [
+    {
+      "type": "MIT",
+      "url": "https://raw.github.com/broofa/node-uuid/master/LICENSE.md"
+    }
+  ],
+  "main": "./uuid.js",
+  "maintainers": [
+    {
+      "name": "broofa",
+      "email": "robert@broofa.com"
+    }
+  ],
+  "name": "node-uuid",
+  "optionalDependencies": {},
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/broofa/node-uuid.git"
+  },
   "scripts": {
-    "test": "node test/test.js",
-    "coverage": "nyc npm test && nyc report"
+    "coverage": "nyc npm test && nyc report",
+    "test": "node test/test.js"
   },
-  "lib"           : ".",
-  "main"          : "./uuid.js",
-  "repository"    : { "type" : "git", "url" : "https://github.com/broofa/node-uuid.git" },
-  "version"       : "1.4.2",
-  "license"       : "MIT",
-  "devDependencies": { "nyc": "^2.2.0" }
-
+  "url": "http://github.com/broofa/node-uuid",
+  "version": "1.4.4"
 }

programming_language: JavaScript
filename: test.js
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,9 @@
 if (!this.uuid) {
   // node.js
   uuid = require('../uuid');
+  if (!/_rb/.test(uuid._rng.toString())) {
+    throw new Error("should use crypto for node.js");
+  }
 }
 
 //

programming_language: JavaScript
filename: uuid.js
change_type: ModificationType.MODIFY
diff: @@ -19,7 +19,7 @@
   // Moderately fast, high quality
   if ('function' === typeof require) {
     try {
-      var _rb = _global.require('crypto').randomBytes;
+      var _rb = require('crypto').randomBytes;
       _rng = _rb && function() {return _rb(16);};
     } catch(e) {}
   }
@@ -226,6 +226,7 @@
   uuid.parse = parse;
   uuid.unparse = unparse;
   uuid.BufferClass = BufferClass;
+  uuid._rng = _rng;
 
   if (typeof(module) != 'undefined' && module.exports) {
     // Publish as node.js module
@@ -233,7 +234,7 @@
   } else  if (typeof define === 'function' && define.amd) {
     // Publish as AMD module
     define(function() {return uuid;});
- 
+
 
   } else {
     // Publish as global (in browsers)

programming_language: JavaScript