-
Notifications
You must be signed in to change notification settings - Fork 32
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix WS-2018-0594 potential non-random UUIDs security issue #78
Conversation
lgtm. @sumukhatv could you help review? |
@xumia Did test/apitest.py pass with this change? |
Test results: Ran 32 tests in 35.470s OK test_vrouter_not_created_all_verbs (main.ra_client_negative_tests) ... ok Ran 23 tests in 24.653s OK |
@sumukhatv , thanks for your comment, there is an API change, fixed. |
@sumukhatv , the test is based on the change: #81 |
Does it mean that we need to merge #81 for the tests to pass for this PR? |
@sumukhatv , this PR does not have any dependencies on the PR #81, the PR is a general fix. The test steps in the readme do not work, it should be another issue. |
@prsunny for visibility |
All the tests are passing. Good to merge: ~/sonic-restapi/test$ python apitest.py Ran 32 tests in 35.560s OK Ran 23 tests in 24.663s OK |
A vulnerability was found in github.com/satori/go.uuid through version v1.2.0. The UUID random generator uses Read() function which has fewer bytes than asked and might cause potential non-random UUIDs.
See advisory for vulnerability details
From CERT: satori/go.uuid@75cca53
More detail alert info can be found on https://msazure.visualstudio.com/One/_componentGovernance/Networking-acs-buildimage/alert/4546641?typeId=5886163
Fix multiple-value uuid.NewV4() in single-value context issue.