| modules: |
| - module: github.com/dinever/golf |
| versions: |
| - fixed: 0.3.0 |
| packages: |
| - package: github.com/dinever/golf |
| symbols: |
| - randomBytes |
| derived_symbols: |
| - Context.Render |
| - Context.RenderFromString |
| description: | |
| CSRF tokens are generated using math/rand, which is not a cryptographically secure |
| rander number generation, making predicting their values relatively trivial and |
| allowing an attacker to bypass CSRF protections which relatively few requests. |
| published: 2021-04-14T20:04:52Z |
| credit: '@elithrar' |
| references: |
| - fix: https://github.com/dinever/golf/pull/24 |
| - fix: https://github.com/dinever/golf/commit/3776f338be48b5bc5e8cf9faff7851fc52a3f1fe |
| - web: https://github.com/dinever/golf/issues/20 |
| cve_metadata: |
| id: CVE-2016-15005 |
| cwe: 'CWE 338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' |
