CVE-2021-4238: Github.com/Masterminds/goutils RandomAlphaNumeric And CryptoRandomAlphaNumeric Are Not Vulnerability
LOWCVE-2021-4238 is a LOW randomalphanumeric and cryptorandomalphanumeric are not vulnerability (CWE-331: Insufficient Entropy) affecting Github.com/Masterminds/goutils libraries in the Go ecosystem. The issue involves randomalphanumeric and cryptorandomalphanumeric are not as random as they should be. Remediation is available by upgrading affected packages to version 1.1.1.
CVE-2021-4238 at a Glance
How to Fix CVE-2021-4238
To remediate this vulnerability, upgrade all affected Github.com/Masterminds/goutils dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/Masterminds/goutils to 1.1.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/Masterminds/goutilsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2021-4238, inspect your project dependencies for Github.com/Masterminds/goutils:
inspect dependencies for github.com/Masterminds/goutilsAnalyze the terminal output to locate any version of Github.com/Masterminds/goutils in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.1.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-331: Insufficient Entropy, where the product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others. In Github.com/Masterminds/goutils, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2021-4238 Affected Github.com/Masterminds/goutils Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/Masterminds/goutils
|
Go |
< 1.1.1
|
1.1.1
|
References
Frequently Asked Questions
What is CVE-2021-4238?
Which Github.com/Masterminds/goutils versions are affected?
What version fixes CVE-2021-4238?
Is github.com/Masterminds/goutils affected?
What CWE is associated with CVE-2021-4238?
How can I check Go dependencies for CVE-2021-4238?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-xg2h-wx96-xgxr",
"modified" : "2026-01-23T22:52:01Z",
"published" : "2021-05-21T16:26:06Z",
"aliases" : [ "CVE-2021-4238" ],
"summary" : "RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be",
"details" : "### Impact\n\nA security-sensitive bug was discovered by Open Source Developer *Erik Sundell of Sundell Open Source Consulting AB*.\n\nThe functions `RandomAlphaNumeric(int)` and `CryptoRandomAlphaNumeric(int)` are not as random as they should be. Small values of `int` in the functions above will return a smaller subset of results than they should. For example, `RandomAlphaNumeric(1)` will always return a digit in the 0-9 range, while `RandomAlphaNumeric(4)` will return around ~7 million of the ~13M possible permutations.\n\nThis is considered a security release because programs that rely upon random generators for passwords are at an increased risk of brute force-style password guessing. There is also a higher probability of collision.\n\nThe problem was the result of a mistaken regular expression that only accepted random strings if they contained a digit from `[0-9]`. That restriction has been removed.\n\n### Patches\n\nThis issue has been corrected in v1.1.1.\n\n### Workarounds\n\nIf you cannot upgrade to v1.1.1, you can work around the issue by calling `RandomAlphaNumericCustom(N, true, true)`|`CryptoRandomAlphaNumericCustom(N, true, true)` instead. (Where `N` is the desired length, and `true` is the literal boolean `true`.)",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/Masterminds/goutils"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.1.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/Masterminds/goutils/security/advisories/GHSA-xg2h-wx96-xgxr"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-4238"
}, {
"type" : "WEB",
"url" : "https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1"
}, {
"type" : "WEB",
"url" : "https://github.com/Masterminds/goutils/commit/f1923532a168b8203bfe956d8cd3b17ebece5982"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/Masterminds/goutils"
}, {
"type" : "WEB",
"url" : "https://github.com/Masterminds/goutils/releases/tag/v1.1.1"
}, {
"type" : "WEB",
"url" : "https://pkg.go.dev/vuln/GO-2022-0411"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-331" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2021-05-21T14:36:56Z",
"nvd_published_at" : null
}
}