Overview
About vulnerability
gorilla/websocket used math/rand (cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with a known value, enabling an attacker to predict or recover mask keys and inject content into WebSocket connections.
Type: Use of Cryptographically Weak Pseudo-Random Number Generator Fix: Replaced math/rand with crypto/rand (commit d67f4185, released in v1.5.3) Credit: bounty-hunter v6.0 silent-fix detection
Details
- Affected product:
- Azure/azure-service-bus-go , FZambia/eagle , Grafana , Loki , TritonDataCenter/triton-go , apache/cassandra-gocql-driver/gocql , caddyserver/caddy , census-ecosystem/opencensus-go-exporter-prometheus/prometheus , centrifugal/centrifuge , cockroachdb/errors , coredns/coredns , cortexproject/cortex , cue.gerrithub/cue-lang/cue , dgraph-io/badger , etcd-io/etcd , etcd-io/etcd/client , etcd-io/etcd/server , getsentry/sentry-go , go-kit/kit , go-openapi/analysis , go-openapi/loads , go-openapi/runtime , go-openapi/strfmt , go-openapi/validate , gobuffalo/depgen , gobuffalo/genny , gobuffalo/packr , golang-migrate/migrate , google/go-cloud , gorilla/websocket , grafana/e2e , grafana/grafana-app-sdk , grafana/grafana-aws-sdk , grafana/grafana-live-sdk , grafana/grafana-plugin-sdk-go , grafana/grafana/apps/playlist , grafana/grafana/pkg/aggregator , grafana/grafana/pkg/apimachinery , grafana/grafana/pkg/apiserver , grafana/grafana/pkg/promlib , grafana/grafana/pkg/storage/unified/apistore , grafana/grafana/pkg/storage/unified/resource , grafana/kindsys , grafana/tempo , grafana/thema , grpc-ecosystem/go-grpc-middleware/providers/kit , hashicorp/consul , hashicorp/go-discover , hashicorp/go-metrics , hashicorp/nomad/api , heroku/x , igm/sockjs-go , influxdata/flux , influxdata/influxdb , influxdata/promql , influxdata/telegraf , jaegertracing/jaeger , kataras/iris , kataras/neffos , kubernetes/api , kubernetes/apimachinery , kubernetes/apiserver , kubernetes/client-go , kubernetes/code-generator , kubernetes/component-base , kubernetes/kube-aggregator , leoluk/perflib_exporter , m3dbx/prometheus_remote_client_golang , moby/spdystream , mongodb/mongo-go-driver , nhooyr/websocket-old , open-telemetry/opentelemetry-collector , openfga/openfga , ory/fosite , ory/x , pressly/goose , prometheus/alertmanager , prometheus/client_golang , prometheus/common , prometheus/exporter-toolkit , prometheus/node_exporter , prometheus/prometheus , prometheus/statsd_exporter , spf13/cobra , spf13/viper , thanos-io/thanos , weaveworks/common
- Affected packages:
- go.etcd.io/etcd @ 0.5.0-alpha.5.0.20200520232829-54ba9589114f (+132 more)