Vulnerability in github.com/foxcpp/maddy: MD5 Hash Support
Summary
GHSA-qh54-9vc5-m9fg: MD5 hash support in github.com/foxcpp/maddy. Affects github.com/foxcpp/maddy versions >= 0.5.0, < 0.5.2. Fixed in 0.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/foxcpp/maddy is a Go package that provides email server functionality. It is used to handle email authentication and other related tasks. The package includes an auth.shadow module that interacts with the system's /etc/shadow file for user authentication. However, an outdated system configuration that allows the use of MD5 hashes in /etc/shadow can lead to a vulnerability in maddy.
Vulnerability Detail
The vulnerability affects maddy versions 0.5.1 and 0.5.0 when using the auth.shadow module on systems that still allow MD5 hashes in /etc/shadow. This vulnerability can be exploited by attackers to compromise user authentication and gain unauthorized access to the email server. The use of MD5 hashes is considered insecure due to their vulnerability to brute-force attacks and the availability of more secure hashing algorithms. The impact of this vulnerability is low, but it is still recommended to address it to ensure the security of the email server.
How To Fix
Minimum fixed version
0.5.2
This is the first release that contains the fix.
go get github.com/foxcpp/maddy@v0.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is important to ensure that MD5 hashes are not present in the /etc/shadow file. This can be achieved by updating the system configuration to disallow the use of MD5 hashes and migrating to more secure hashing algorithms for user passwords.
Conclusion
In conclusion, the vulnerability in github.com/foxcpp/maddy allows unauthorized access to the email server by exploiting the use of MD5 hashes in the system's /etc/shadow file. To mitigate this vulnerability, it is recommended to update to maddy version 0.5.2 or later and ensure that MD5 hashes are not present in the /etc/shadow file. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/foxcpp/maddy →
FAQ
The impact of this vulnerability is low, but it can lead to unauthorized access to the email server and compromise user authentication.
The vulnerability affects maddy versions 0.5.1 and 0.5.0.
It is recommended to update to maddy version 0.5.2 or later to fix this vulnerability.
No, this vulnerability requires access to the system's /etc/shadow file.
MD5 hashes are considered insecure due to their vulnerability to brute-force attacks and the availability of more secure hashing algorithms.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/foxcpp/maddy.
