modules:
  - module: github.com/go-macaron/csrf
    versions:
      - fixed: 0.0.0-20180426211050-dadd1711a617
    vulnerable_at: 0.0.0-20170207230724-428b7c62d7d0
    packages:
      - package: github.com/go-macaron/csrf
description: |
    The Options.Secure value is ignored, and cookies created by Generate never
    have the secure attribute.
cves:
  - CVE-2018-25060
references:
  - fix: https://github.com/go-macaron/csrf/pull/7
  - fix: https://github.com/go-macaron/csrf/commit/dadd1711a617000b70e5e408a76531b73187031c