search

coupergateway / couper

Couper is a lightweight API gateway designed to support developers in building and operating API-driven Web projects
https://couper.io
MIT License
85 stars 15 forks source link

Fixed CVE-2021-3538 related to the non-default `uuid4` `request_id_format` option #611

Closed malud closed 2 years ago

malud commented 2 years ago

Related to a security scan we will switch the underlying package from github.com/satori/go.uuid (https://github.com/satori/go.uuid/issues/73) to github.com/google/uuid.

Our default format is https://github.com/rs/xid, which maps to the common option. The user have explicitly enable uuid4 in the request_id_format attribute within the settings block.

Reviewer checklist
  • Read PR description: a summary about the changes is required
  • Changelog updated
  • Documentation: docs/{Reference, Cli, ...}, Docker and cli help/usage
  • Pulled branch, manually tested
  • Verified requirements are met
  • Reviewed the code
  • Reviewed the related tests