Vulnerability in accounts package: Hash account number using Salt
Summary
GHSA-g636-q5fc-4pr7: accounts: Hash account number using Salt. Affects github.com/moov-io/customers versions < 0.5.0. Fixed in 0.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The accounts package is a part of the Moov-io customers repository, written in Go. It is responsible for handling account-related operations. One of the key functionalities of this package is hashing the account number for security purposes. However, a vulnerability has been identified in the current implementation, where the account number is not salted during the hashing process. This makes it susceptible to a rainbow table attack, compromising the security of the account numbers.
Vulnerability Detail
The vulnerability arises from the absence of salting the account number during the hashing process. Salting involves adding a random number (salt) to the account number before hashing, making it more resistant to rainbow table attacks. Without salting, an attacker can precompute a table of hash values for commonly used account numbers and easily reverse-engineer the original account numbers. This can lead to unauthorized access, identity theft, and other malicious activities. The vulnerability has a low severity rating.
How To Fix
Minimum fixed version
0.5.0
This is the first release that contains the fix.
go get github.com/moov-io/customers@v0.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the package to the fixed version.
Conclusion
The accounts package in the Moov-io customers repository is vulnerable to a rainbow table attack due to the absence of salting during the hashing process of account numbers. To mitigate this vulnerability, it is recommended to update the package to version 0.5.0 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/moov-io/customers →
FAQ
The vulnerability allows attackers to easily reverse-engineer hashed account numbers, potentially leading to unauthorized access and identity theft.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Salting involves adding a random number to the input before hashing. It enhances security by making it more difficult for attackers to precompute hash values for commonly used inputs.
Yes, the vulnerability exists in versions prior to 0.5.0 of the Moov-io customers repository. The fix has been implemented in version 0.5.0.
The vulnerability has a low severity rating.
