| packages: |
| - module: github.com/dinever/golf |
| symbols: |
| - randomBytes |
| derived_symbols: |
| - Context.Render |
| - Context.RenderFromString |
| versions: |
| - fixed: 0.3.0 |
| description: | |
| CSRF tokens are generated using math/rand, which is not a cryptographically secure |
| rander number generation, making predicting their values relatively trivial and |
| allowing an attacker to bypass CSRF protections which relatively few requests. |
| published: 2021-04-14T20:04:52Z |
| credit: '@elithrar' |
| cve_metadata: |
| id: CVE-2016-15005 |
| cwe: "CWE 338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)" |
| links: |
| pr: https://github.com/dinever/golf/pull/24 |
| commit: https://github.com/dinever/golf/commit/3776f338be48b5bc5e8cf9faff7851fc52a3f1fe |
| context: |
| - https://github.com/dinever/golf/issues/20 |
