GHSA-w67g-5rqw-f597
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
Quick fix
GHSA-w67g-5rqw-f597 — github.com/gorilla/websocket: upgrade to the fixed version with the command below.
go get github.com/gorilla/websocket@v1.5.3Details
gorilla/websocket used `math/rand` (cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with a known value, enabling an attacker to predict or recover mask keys and inject content into WebSocket connections.
**Type:** Use of Cryptographically Weak Pseudo-Random Number Generator **Fix:** Replaced math/rand with crypto/rand (commit d67f4185, released in v1.5.3) **Credit:** bounty-hunter v6.0 silent-fix detection
Are you affected?
Enter the version of the package you're using.
Affected packages
0 Fixed in: 1.5.3 go get github.com/gorilla/websocket@v1.5.3 References
- https://github.com/canolgun-commits/websocket/security/advisories/GHSA-w67g-5rqw-f597 [WEB]
- https://github.com/gorilla/websocket/commit/d67f41855da42d7bccd9ef050c49f7e54e783b95 [WEB]
- https://github.com/canolgun-commits/websocket [PACKAGE]
- https://github.com/gorilla/websocket/releases/tag/v1.5.3 [WEB]