GHSA-w67g-5rqw-f597

About vulnerability

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket

Affected product:

Azure/azure-service-bus-go , ClickHouse/clickhouse-go , FZambia/eagle , Grafana , Loki , MinIO , TritonDataCenter/triton-go , apache/cassandra-gocql-driver/gocql , argoproj/gitops-engine , argoproj/notifications-engine , argoproj/pkg , bwmarrin/discordgo , caddyserver/caddy , census-ecosystem/opencensus-go-exporter-prometheus/prometheus , census-ecosystem/opencensus-go-exporter-stackdriver/stackdriver , centrifugal/centrifuge , centrifugal/centrifuge-go , cockroachdb/errors , containerd/aufs , containerd/containerd , containerd/continuity , containerd/imgcrypt , containerd/zfs , containernetworking/plugins , coredns/coredns , cortexproject/cortex , cue.gerrithub/cue-lang/cue , dgraph-io/badger , distribution/distribution , etcd-io/etcd , etcd-io/etcd/client , etcd-io/etcd/etcdctl , etcd-io/etcd/etcdutl , etcd-io/etcd/pkg , etcd-io/etcd/server , etcd-io/etcd/tests , fullstorydev/grpcurl , getsentry/sentry-go , go-kit/kit , go-openapi/analysis , go-openapi/loads , go-openapi/runtime , go-openapi/strfmt , go-openapi/validate , gobuffalo/buffalo-plugins , gobuffalo/depgen , gobuffalo/envy , gobuffalo/genny , gobuffalo/gogen , gobuffalo/helpers , gobuffalo/licenser , gobuffalo/packr , gobuffalo/plushgen , gobuffalo/pop , gobuffalo/release , golang-migrate/migrate , gomodules/notify , google/certificate-transparency-go , google/go-attestation , google/go-cloud , google/go-containerregistry , google/go-licenses , google/go-tpm , google/go-tpm-tools , google/go-tspi , google/trillian , goreleaser/goreleaser , gorilla/websocket , grafana/dskit , grafana/e2e , grafana/grafana-app-sdk , grafana/grafana-aws-sdk , grafana/grafana-live-sdk , grafana/grafana-plugin-sdk-go , grafana/grafana/apps/investigation , grafana/grafana/apps/playlist , grafana/grafana/pkg/aggregator , grafana/grafana/pkg/apimachinery , grafana/grafana/pkg/apiserver , grafana/grafana/pkg/promlib , grafana/grafana/pkg/storage/unified/apistore , grafana/grafana/pkg/storage/unified/resource , grafana/kindsys , grafana/tempo , grafana/thema , grpc-ecosystem/go-grpc-middleware , grpc-ecosystem/go-grpc-middleware/providers/kit , hashicorp/consul , hashicorp/go-discover , hashicorp/go-metrics , hashicorp/nomad/api , heroku/x , igm/sockjs-go , improbable-eng/grpc-web , influxdata/flux , influxdata/influxdb , influxdata/promql , influxdata/telegraf , intel/goresctrl , iris-contrib/httpexpect , jaegertracing/jaeger , kataras/iris , kataras/neffos , kubernetes-sigs/controller-runtime , kubernetes/api , kubernetes/apiextensions-apiserver , kubernetes/apimachinery , kubernetes/apiserver , kubernetes/cli-runtime , kubernetes/client-go , kubernetes/cloud-provider , kubernetes/code-generator , kubernetes/component-base , kubernetes/component-helpers , kubernetes/controller-manager , kubernetes/cri-client , kubernetes/dynamic-resource-allocation , kubernetes/endpointslice , kubernetes/klog , kubernetes/kube-aggregator , kubernetes/kube-openapi , kubernetes/kubectl , kubernetes/kubelet , kubernetes/kubernetes , kubernetes/metrics , kubernetes/pod-security-admission , kubernetes/sample-apiserver , kubernetes/utils , leoluk/perflib_exporter , m3dbx/prometheus_remote_client_golang , microsoft/hcsshim , minio/pkg , mkevac/debugcharts , moby/spdystream , mongodb/mongo-go-driver , nhooyr/websocket-old , oapi-codegen/runtime , open-policy-agent/opa , open-telemetry/opentelemetry-collector , openfga/openfga , oras-project/oras-go , ory/analytics-go , ory/dockertest , ory/fosite , ory/go-acc , ory/herodot , ory/jsonschema , ory/viper , ory/x , pressly/goose , prometheus/alertmanager , prometheus/client_golang , prometheus/common , prometheus/exporter-toolkit , prometheus/node_exporter , prometheus/prom2json , prometheus/prometheus , prometheus/statsd_exporter , slack-go/slack , spf13/cobra , spf13/viper , thanos-io/objstore , thanos-io/thanos , tmc/grpc-websocket-proxy , weaveworks/common

Affected packages:

github.com/gorilla/websocket @ 1.5.0 (+413 more)