CVE-2021-4238

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.

• CWE-331

• https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1Patch, Third Party Advisory
• https://pkg.go.dev/vuln/GO-2022-0411Exploit, Patch, Third Party Advisory
• https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1Patch, Third Party Advisory
• https://pkg.go.dev/vuln/GO-2022-0411Exploit, Patch, Third Party Advisory

Published

Dec 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42374An out-of-bounds heap read in Busybox's unlzma applet leads …5.3
• CVE-2021-42375An incorrect handling of a special element in Busybox's ash …5.5
• CVE-2021-42376A NULL pointer dereference in Busybox's hush applet leads to…5.5
• CVE-2021-42377An attacker-controlled pointer free in Busybox's hush applet…9.8
• CVE-2021-42378A use-after-free in Busybox's awk applet leads to denial of …7.2
• CVE-2021-42379A use-after-free in Busybox's awk applet leads to denial of …7.2
• CVE-2021-42380A use-after-free in Busybox's awk applet leads to denial of …7.2
• CVE-2021-42381A use-after-free in Busybox's awk applet leads to denial of …7.2
• CVE-2021-42382A use-after-free in Busybox's awk applet leads to denial of …7.2
• CVE-2021-42383A use-after-free in Busybox's awk applet leads to denial of …7.2
• CVE-2021-42384A use-after-free in Busybox's awk applet leads to denial of …7.2
• CVE-2021-42385A use-after-free in Busybox's awk applet leads to denial of …7.2