Generation of Predictable Numbers or Identifiers Affecting github.com/google/gvisor/pkg/rand package, versions <20231113.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMGOOGLEGVISORPKGRAND-8679620
- published31 Jan 2025
- disclosed31 Jan 2025
- creditInon Kaplan, Ron Even, Amit Klein
Introduced: 31 Jan 2025
NewCVE-2024-10603 Â (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/google/gvisor/pkg/rand to version 20231113.0.0 or higher.
Overview
Affected versions of this package are vulnerable to Generation of Predictable Numbers or Identifiers in the generation of TCP/UDP source ports and other header values. An attacker can potentially intercept or manipulate packets by predicting these values in certain circumstances.