Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
Goose does not use this library in any of the production code. Since this is a javascript lib, it is mainly used in the webui (desktop) and documentation, and we only ship CLI, which uses a different nanoid package: https://crates.io/crates/nanoid (as it seems, not affected). Upstream goose seems to be using versions that are not affected as well, so it should be clear and that is not affecting anyone anywhere. * https://github.com/aaif-goose/goose/blob/main/documentation/package-lock.json#L13720 * https://github.com/aaif-goose/goose/blob/main/ui/pnpm-lock.yaml#L13697