Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc2MzYtcTVmYy00cHI3

accounts: Hash account number using Salt

@alovak found that currently when we build hash of account number we do not "salt" it. Which makes it vulnerable to rainbow table attack.

What did you expect to see?
I expected salt (some random number from configuration) to be used in hash.AccountNumber

I would generate salt per tenant at least (maybe per organization).

Permalink: https://github.com/advisories/GHSA-g636-q5fc-4pr7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc2MzYtcTVmYy00cHI3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: almost 3 years ago
Updated: over 1 year ago

Identifiers: GHSA-g636-q5fc-4pr7
References:

• https://github.com/moov-io/customers/security/advisories/GHSA-g636-q5fc-4pr7
• https://github.com/advisories/GHSA-g636-q5fc-4pr7

Repository: https://github.com/moov-io/customers
Blast Radius: 0.0

Affected Packages