THREAT OPS › Threat News › [GHSA] GHSA-w67g-5rqw-f597 (medium) — Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
[GHSA] GHSA-w67g-5rqw-f597 (medium) — Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
GHSA-w67g-5rqw-f597 Severity: medium CVE: None
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
gorilla/websocket used `math/rand` (cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic
MITRE ATT&CK techniques
- Content InjectionT1659
Original source: https://github.com/advisories/GHSA-w67g-5rqw-f597