x/vulndb: potential Go vuln in github.com/greenpau/caddy-security: CVE-2024-21495

[GoVulnBot]

CVE-2024-21495 references github.com/greenpau/caddy-security, which may be a Go module.

Description:
Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-21495
• JSON: https://github.com/CVEProject/cvelist/tree/8a202d4711673a62bfbea84c4495b72c8511ecfe/2024/21xxx/CVE-2024-21495.json
• web: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275
• fix: greenpau/go-authcrunch@ecd3725
• web: https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
• report: Insecure Randomness greenpau/caddy-security#265
• Imported by: https://pkg.go.dev/Path is unknown?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: Path is unknown
      packages:
        - package: github.com/greenpau/caddy-security
cves:
    - CVE-2024-21495
references:
    - web: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275
    - fix: https://github.com/greenpau/go-authcrunch/commit/ecd3725baf2683eb1519bb3c81ae41085fbf7dc2
    - web: https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
    - report: https://github.com/greenpau/caddy-security/issues/265

[gopherbot]

Change https://go.dev/cl/568036 mentions this issue: data/excluded: batch add 23 excluded reports

[gopherbot]

Change https://go.dev/cl/592778 mentions this issue: data/reports: unexclude 80 reports