GHSA-g636-q5fc-4pr7
Suggest an improvement- Source
- https://github.com/advisories/GHSA-g636-q5fc-4pr7
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-g636-q5fc-4pr7/GHSA-g636-q5fc-4pr7.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-g636-q5fc-4pr7
- Published
- 2021-05-24T17:00:27Z
- Modified
- 2021-05-21T22:11:53Z
- Summary
- accounts: Hash account number using Salt
- Details
-
@alovak found that currently when we build hash of account number we do not "salt" it. Which makes it vulnerable to rainbow table attack.
What did you expect to see? I expected salt (some random number from configuration) to be used in hash.AccountNumber
I would generate salt per tenant at least (maybe per organization).
- Database specific
{ "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2021-05-21T22:11:53Z", "nvd_published_at": null, "severity": "LOW" }- References
Affected packages
Go / github.com/moov-io/customers
Package
- Name
- github.com/moov-io/customers
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/moov-io/customers