CVE-2016-15005 Cryptographically weak random number generation in github.com/dinever/golf

🗓️ 27 Dec 2022 21:13:27Reported by GoType

Cryptographically Weak Random Number Generation in github.com/dinever/golf. Predictable CSRF Tokens

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2016-15005	28 Dec 202200:12	–	circl
CNNVD	Golf 跨站请求伪造漏洞	27 Dec 202200:00	–	cnnvd
CVE	CVE-2016-15005	27 Dec 202221:13	–	cve
EUVD	EUVD-2022-7716	3 Oct 202520:07	–	euvd
Github Security Blog	Golf may allow attacker to bypass CSRF protections due to weak PRNG	28 Dec 202200:30	–	github
NVD	CVE-2016-15005	27 Dec 202222:15	–	nvd
OSV	GHSA-Q9QR-JWPW-3QVV Golf may allow attacker to bypass CSRF protections due to weak PRNG	28 Dec 202200:30	–	osv
OSV	GO-2020-0045 Cryptographically weak random number generation in github.com/dinever/golf	14 Apr 202120:04	–	osv
Prion	Cross site request forgery (csrf)	27 Dec 202222:15	–	prion
RedhatCVE	CVE-2016-15005	22 May 202502:27	–	redhatcve

[
  {
    "vendor": "github.com/dinever/golf",
    "product": "github.com/dinever/golf",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "github.com/dinever/golf",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.3.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "randomBytes"
      },
      {
        "name": "Context.Render"
      },
      {
        "name": "Context.RenderFromString"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
pkg	www.pkg.go.dev/vuln/GO-2020-0045
github	www.github.com/dinever/golf/commit/3776f338be48b5bc5e8cf9faff7851fc52a3f1fe
github	www.github.com/dinever/golf/issues/20
github	www.github.com/dinever/golf/pull/24

12 Jun 2023 19:04Current

8.7High risk

Vulners AI Score8.7

EPSS0.00199