CVE-2018-25060

Name	CVE-2018-25060
Description	A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookie without secure attribute. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as dadd1711a617000b70e5e408a76531b73187031c. It is recommended to apply a patch to fix this issue. VDB-217058 is the identifier assigned to this vulnerability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1033115

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-go-macaron-csrf (PTS)	buster	0.0~git20170207.0.428b7c6-4	vulnerable
	bullseye	0.0~git20170207.0.428b7c6-5	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-github-go-macaron-csrf	source	(unstable)	(unfixed)			1033115

Notes

[bullseye] - golang-github-go-macaron-csrf <ignored> (Minor issue, no reverse deps)
[buster] - golang-github-go-macaron-csrf <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
https://github.com/go-macaron/csrf/commit/dadd1711a617000b70e5e408a76531b73187031c
https://github.com/go-macaron/csrf/pull/7