foxcpp/maddy · Security
MD5 hash support in github.com/foxcpp/maddy
- GHSA ID
- GHSA-qh54-9vc5-m9fg
- Severity
- low
- Published
- Updated
- CVSS
- 3 · CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
- CVSS v3
- 3 · CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Description
Impact
This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module and an extremely outdated system that still allows MD5 hashes in /etc/shadows.
Patches
Patch is available as part of the 0.5.2 release.
Workarounds
Ensure MD5 hashes are not present in /etc/shadow.
CWEs
- CWE-261 · Weak Encoding for Password