-
Notifications
You must be signed in to change notification settings - Fork 472
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
telemetry: replace the uuid package dependency #3715
Conversation
Codecov Report
@@ Coverage Diff @@
## master #3715 +/- ##
=======================================
Coverage 49.55% 49.56%
=======================================
Files 391 392 +1
Lines 68550 68561 +11
=======================================
+ Hits 33973 33981 +8
- Misses 30840 30844 +4
+ Partials 3737 3736 -1
Continue to review full report at Codecov.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Seems fine to me.
Summary
The
satori/go.uuid
dependency was reported to contain a vulnerability ( https://nvd.nist.gov/vuln/detail/CVE-2021-3538#VulnChangeHistorySection ).While this vulnerability would have no negative impact on the Algorand blockchain, it does mislead automated vulnerability detectors and points the Algorand codebase to be considered insecure.
Given that this package was used in so few locations, and in such a small scope, I have removed the usage of it completely. Instead, I have implemented a random UUID which would work correctly for our needs.
Test Plan
Unit tests added.