GHSA-qmq6-f8pr-cx5x
Duplicate Advisory: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
- Severity
- 3.2 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-670 Always-Incorrect Control Flow Implementation
- Fix
14.0.0- Upgrade uuid to this version or later
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-w5hq-g745-h8pq. This link is maintained to preserve external references.
Original Advisory
uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.
Affected versions
npm
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
uuid npm → 14.0.0
- npm
npm install uuid@14.0.0- yarn
yarn add uuid@14.0.0- pnpm
pnpm add uuid@14.0.0
Severity breakdown
CVSS 3.1 3.2
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-670: Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
References
Advisories
Fixes and patches
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-w5hq-g745-h8pq uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided | Medium | Also affects uuid |
| GHSA-vg88-3v92-rjx2 Vyper: Return inside for loop more than 1 level deep | Low | Same weakness, CWE-670 |
| GHSA-q49f-xg75-m9xw Wasmtime has host panic when Winch compiler executes `table.fill` | High | Same weakness, CWE-670 |
| GHSA-9f4w-67g7-mqwv OpenClaw: Endpoint persists after trust decline, leaking gateway credentials | Medium | Same weakness, CWE-670 |
| GHSA-v4wr-j3w6-mxqc tough terminating targets role delegations are not respected | Medium | Same weakness, CWE-670 |
| GHSA-vgf2-gvx8-xwc3 Vyper Does Not Check the Success of Certain Precompile Calls | High | Same weakness, CWE-670 |
| GHSA-hm3c-93pg-4cxw In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring | Medium | Same weakness, CWE-670 |
| GHSA-q8hx-mm92-4wvg wasmtime has a runtime crash when combining tail calls with trapping imports | Medium | Same weakness, CWE-670 |
Credits: julianladisch
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor