Debian Package Tracker
Register | Log in
Subscribe

golang-github-gorilla-csrf

Cross Site Request Forgery (CSRF) prevention middleware for Go

Choose email to subscribe with

general
  • source: golang-github-gorilla-csrf (main)
  • version: 1.7.2+ds1-2
  • maintainer: Debian Go Packaging Team (DMD)
  • uploaders: Anthony Fok [DMD]
  • arch: all
  • std-ver: 4.7.0
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 1.6.2-2
  • o-o-sec: 1.6.2-2+deb11u1
  • oldstable: 1.7.1-1
  • old-bpo: 1.7.2-1~bpo12+1
  • stable: 1.7.2+ds1-2
  • testing: 1.7.2+ds1-2
  • unstable: 1.7.2+ds1-2
versioned links
  • 1.6.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.6.2-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.7.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.7.2-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.7.2+ds1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • golang-github-gorilla-csrf-dev
action needed
A new upstream version is available: 1.7.3 high
A new upstream version 1.7.3 is available, you should consider packaging it.
Created: 2025-04-17 Last update: 2025-09-04 10:00
2 security issues in bookworm high

There are 2 open security issues in bookworm.

1 important issue:
  • CVE-2025-47909: Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.
1 issue left for the package maintainer to handle:
  • CVE-2025-24358: (needs triaging) gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes the request is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is never populated for "server" requests per the Go spec, and so this check does not run in practice. This vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform authenticated form submissions against gorilla/csrf protected targets that share the same top level domain. This vulnerability is fixed in 1.7.2.

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-04-17 Last update: 2025-08-31 08:00
1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:
  • CVE-2025-47909: Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.
Created: 2025-08-31 Last update: 2025-08-31 08:00
1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:
  • CVE-2025-47909: Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.
Created: 2025-08-31 Last update: 2025-08-31 08:00
1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:
  • CVE-2025-47909: Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.
Created: 2025-08-31 Last update: 2025-08-31 08:00
1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:
  • CVE-2025-47909: Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.
Created: 2025-08-31 Last update: 2025-08-31 08:00
lintian reports 1 warning normal
Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.
Created: 2025-03-08 Last update: 2025-03-08 11:02
debian/patches: 1 patch to forward upstream low

Among the 2 debian patches available in version 1.7.2+ds1-2 of the package, we noticed the following issues:

  • 1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2025-04-28 Last update: 2025-04-28 19:33
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.7.0).
Created: 2024-04-07 Last update: 2025-04-28 16:00
news
[rss feed]
  • [2025-05-08] golang-github-gorilla-csrf 1.7.2+ds1-2 MIGRATED to testing (Debian testing watch)
  • [2025-04-30] Accepted golang-github-gorilla-csrf 1.6.2-2+deb11u1 (source) into oldstable-security (Andrej Shadura) (signed by: Andrew Shadura)
  • [2025-04-28] Accepted golang-github-gorilla-csrf 1.7.2+ds1-2 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
  • [2025-03-10] golang-github-gorilla-csrf 1.7.2+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2025-03-08] Accepted golang-github-gorilla-csrf 1.7.2+ds1-1 (source) into unstable (Martina Ferrari)
  • [2024-03-13] Accepted golang-github-gorilla-csrf 1.7.2-1~bpo12+1 (source all) into stable-backports (Debian FTP Masters) (signed by: Anthony Fok)
  • [2023-12-11] golang-github-gorilla-csrf 1.7.2-1 MIGRATED to testing (Debian testing watch)
  • [2023-12-09] Accepted golang-github-gorilla-csrf 1.7.2-1 (source) into unstable (Anthony Fok)
  • [2023-04-03] golang-github-gorilla-csrf 1.7.1-1 MIGRATED to testing (Debian testing watch)
  • [2023-03-13] Accepted golang-github-gorilla-csrf 1.7.1-1 (source) into unstable (Anthony Fok)
  • [2022-12-23] golang-github-gorilla-csrf 1.6.2-4 MIGRATED to testing (Debian testing watch)
  • [2022-12-17] Accepted golang-github-gorilla-csrf 1.6.2-4 (source) into unstable (Jelmer Vernooij) (signed by: Jelmer Vernooij)
  • [2020-12-08] Accepted golang-github-gorilla-csrf 1.6.2-2~bpo10+1 (source all) into buster-backports, buster-backports (Debian FTP Masters) (signed by: Anthony Fok)
  • [2020-01-08] golang-github-gorilla-csrf 1.6.2-2 MIGRATED to testing (Debian testing watch)
  • [2020-01-06] Accepted golang-github-gorilla-csrf 1.6.2-2 (source) into unstable (Anthony Fok)
  • [2019-12-25] Accepted golang-github-gorilla-csrf 1.6.2-1 (source all) into unstable, unstable (Anthony Fok)
bugs [bug history graph]
  • all: 0
links
  • homepage
  • lintian (0, 1)
  • buildd: logs, reproducibility
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 1.7.2+ds1-2

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing