What is GHSA-qh54-9vc5-m9fg?

GHSA-qh54-9vc5-m9fg is a security advisory published by GitHub Security Advisories with Low severity. MD5 hash support in github.com/foxcpp/maddy

Why does GHSA-qh54-9vc5-m9fg have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-qh54-9vc5-m9fg?

GHSA-qh54-9vc5-m9fg has a CVSS v3 base score of 3.0, published by GitHub Security Advisories.

Which products are affected by GHSA-qh54-9vc5-m9fg?

GHSA-qh54-9vc5-m9fg affects 1 product, including: go/github.com/foxcpp/maddy:\u003e= 0.5.0, \u003c 0.5.2.

GHSA-qh54-9vc5-m9fgLowCVSS 3.0Disclosed before NVD

MD5 hash support in github.com/foxcpp/maddy

Vendor

GitHub Security Advisories

Published

October 12, 2021

Last Modified

January 9, 2023

📋 Description

Impact

This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module and an extremely outdated system that still allows MD5 hashes in /etc/shadows.

Patches

Patch is available as part of the 0.5.2 release.

Workarounds

Ensure MD5 hashes are not present in /etc/shadow.

🎯 Affected products1

go/github.com/foxcpp/maddy:>= 0.5.0, < 0.5.2

🔗 References (2)

https://github.com/foxcpp/maddy/security/advisories/GHSA-qh54-9vc5-m9fg
https://github.com/advisories/GHSA-qh54-9vc5-m9fg