Program: CWE-79
Project: CVE-2019-8400
Buggy source:
module github.com/ory/hydra

require (
	github.com/dgrijalva/jwt-go v3.2.0+incompatible
	github.com/go-sql-driver/mysql v1.4.0
	github.com/gobuffalo/packd v0.0.0-20181029140631-cf76bd87a5a6 // indirect
	github.com/gobwas/glob v0.2.3
	github.com/golang/mock v1.1.1
	github.com/gorilla/context v1.1.1
	github.com/gorilla/securecookie v0.0.0-20160422134519-667fe4e3466a
	github.com/gorilla/sessions v0.0.0-20160922145804-ca9ada445741
	github.com/gtank/cryptopasta v0.0.0-20170601214702-1f550f6f2f69
	github.com/imdario/mergo v0.0.0-20171009183408-7fe0c75c13ab
	github.com/jmoiron/sqlx v0.0.0-20180614180643-0dae4fefe7c0
	github.com/julienschmidt/httprouter v0.0.0-20180715161854-348b672cd90d
	github.com/lib/pq v1.0.0
	github.com/meatballhat/negroni-logrus v0.0.0-20170801195057-31067281800f
	github.com/mendsley/gojwk v0.0.0-20141217222730-4d5ec6e58103
	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
	github.com/oleiade/reflections v1.0.0
	github.com/opentracing/opentracing-go v1.0.2
	github.com/ory/dockertest v3.3.2+incompatible
	github.com/ory/fosite v0.28.0
	github.com/ory/go-convenience v0.1.0
	github.com/ory/graceful v0.1.0
	github.com/ory/herodot v0.4.1
	github.com/ory/sqlcon v0.0.7
	github.com/ory/x v0.0.32
	github.com/pborman/uuid v1.2.0
	github.com/phayes/freeport v0.0.0-20171002181615-b8543db493a5
	github.com/pkg/errors v0.8.0
	github.com/prometheus/client_golang v0.8.0
	github.com/rs/cors v1.6.0
	github.com/rubenv/sql-migrate v0.0.0-20180704111356-ba2c6a7295c59448dbc195cef2f41df5163b3892
	github.com/sirupsen/logrus v1.1.1
	github.com/spf13/cobra v0.0.3
	github.com/spf13/viper v1.2.1
	github.com/stretchr/testify v1.2.2
	github.com/toqueteos/webbrowser v0.0.0-20150720201625-21fc9f95c834
	github.com/uber-go/atomic v1.3.2 // indirect
	github.com/uber/jaeger-client-go v2.15.0+incompatible
	github.com/urfave/negroni v1.0.0
	github.com/ziutek/mymysql v1.5.4 // indirect
	go.uber.org/atomic v1.3.2 // indirect
	golang.org/x/crypto v0.0.0-20181001203147-e3636079e1a4
	golang.org/x/net v0.0.0-20181029044818-c44066c5c816 // indirect
	golang.org/x/oauth2 v0.0.0-20181003184128-c57b0facaced
	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
	gopkg.in/resty.v1 v1.9.1
	gopkg.in/square/go-jose.v2 v2.1.9
	gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0
)


Fixed version (ground truth):
module github.com/ory/hydra

require (
	github.com/dgrijalva/jwt-go v3.2.0+incompatible
	github.com/go-sql-driver/mysql v1.4.0
	github.com/gobuffalo/packd v0.0.0-20181029140631-cf76bd87a5a6 // indirect
	github.com/gobwas/glob v0.2.3
	github.com/golang/mock v1.1.1
	github.com/gorilla/context v1.1.1
	github.com/gorilla/securecookie v0.0.0-20160422134519-667fe4e3466a
	github.com/gorilla/sessions v0.0.0-20160922145804-ca9ada445741
	github.com/gtank/cryptopasta v0.0.0-20170601214702-1f550f6f2f69
	github.com/imdario/mergo v0.0.0-20171009183408-7fe0c75c13ab
	github.com/jmoiron/sqlx v0.0.0-20180614180643-0dae4fefe7c0
	github.com/julienschmidt/httprouter v0.0.0-20180715161854-348b672cd90d
	github.com/lib/pq v1.0.0
	github.com/meatballhat/negroni-logrus v0.0.0-20170801195057-31067281800f
	github.com/mendsley/gojwk v0.0.0-20141217222730-4d5ec6e58103
	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
	github.com/oleiade/reflections v1.0.0
	github.com/opentracing/opentracing-go v1.0.2
	github.com/ory/dockertest v3.3.2+incompatible
	github.com/ory/fosite v0.28.0
	github.com/ory/go-convenience v0.1.0
	github.com/ory/graceful v0.1.0
	github.com/ory/herodot v0.4.1
	github.com/ory/sqlcon v0.0.7
	github.com/ory/x v0.0.32
	github.com/pborman/uuid v1.2.0
	github.com/phayes/freeport v0.0.0-20171002181615-b8543db493a5
	github.com/pkg/errors v0.8.0
	github.com/prometheus/client_golang v0.8.0
	github.com/rs/cors v1.6.0
	github.com/rubenv/sql-migrate v0.0.0-20180704111356-ba2c6a7295c59448dbc195cef2f41df5163b3892
	github.com/sirupsen/logrus v1.1.1
	github.com/spf13/cobra v0.0.3
	github.com/spf13/viper v1.2.1
	github.com/stretchr/testify v1.2.2
	github.com/toqueteos/webbrowser v0.0.0-20150720201625-21fc9f95c834
	github.com/uber-go/atomic v1.3.2 // indirect
	github.com/uber/jaeger-client-go v2.15.0+incompatible
	github.com/urfave/negroni v1.0.0
	github.com/ziutek/mymysql v1.5.4 // indirect
	go.uber.org/atomic v1.3.2 // indirect
	golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9
	golang.org/x/net v0.0.0-20181029044818-c44066c5c816 // indirect
	golang.org/x/oauth2 v0.0.0-20181003184128-c57b0facaced
	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
	gopkg.in/resty.v1 v1.9.1
	gopkg.in/square/go-jose.v2 v2.1.9
	gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0
)