CVE-2016-15005: Cryptographically weak random number generation in github.com/dinever/golf
Summary
CVE-2016-15005: Golf may allow attacker to bypass CSRF protections due to weak PRNG. Affects github.com/dinever/golf versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/dinever/golf is a Go package that provides a lightweight web framework for building web applications. It includes functionalities such as rendering templates, handling HTTP requests, and generating CSRF tokens for protection against cross-site request forgery (CSRF) attacks. However, the package uses the math/rand random number generator, which is not cryptographically secure.
Vulnerability Detail
The vulnerability (CVE-2016-15005) in github.com/dinever/golf arises from the use of the math/rand random number generator for generating CSRF tokens. This generator is not suitable for cryptographic purposes as it produces predictable and easily guessable values. An attacker can exploit this weakness by predicting the CSRF token values and bypassing the CSRF protection mechanism with a relatively small number of requests. This can lead to unauthorized actions being performed on behalf of the victim user, potentially compromising the security and integrity of the application.
How To Fix
Latest published version: v0.3.0 as of 23 Oct 2026
go get github.com/dinever/golf@v0.3.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.0
This is the first release that contains the fix.
go get github.com/dinever/golf@v0.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually replace the usage of the vulnerable random number generator in the codebase with a cryptographically secure alternative, such as crypto/rand. Here is an example of how the randomBytes function in github.com/dinever/golf can be modified:
Before:
github.com/dinever/golf.randomBytes = func(n int) []byte {
b := make([]byte, n)
for i := 0; i < n; i++ {
b[i] = byte(rand.Int())
}
return b
}
After:
github.com/dinever/golf.randomBytes = func(n int) []byte {
b := make([]byte, n)
_, err := rand.Read(b)
if err != nil {
// Handle error
}
return b
}
Conclusion
In conclusion, the use of a cryptographically weak random number generator in github.com/dinever/golf for generating CSRF tokens poses a security risk. It is crucial to update the package to use a secure random number generator, such as crypto/rand, to mitigate the vulnerability. Developers should update to version 0.3.0 or higher of the package and follow the recommended steps to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/dinever/golf →
FAQ
The vulnerability allows an attacker to predict CSRF token values and bypass CSRF protections. This can lead to unauthorized actions being performed on behalf of users, potentially compromising the security and integrity of the application.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities, including this one.
Yes, a fix has been released in version 0.3.0 of github.com/dinever/golf. It is recommended to update to this version or higher to address the vulnerability.
Yes, a temporary workaround is to manually replace the usage of the vulnerable random number generator in the codebase with a cryptographically secure alternative, such as crypto/rand. Please refer to the 'workaround' section for more details.
This vulnerability was discovered by @elithrar.
