GHSA-qh54-9vc5-m9fg MD5 hash support in github.com/foxcpp/maddy
Maddy mail server allows weak MD5 hashes in shadow files, enabling potential authentication bypass on outdated systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-qh54-9vc5-m9fg?
GHSA-qh54-9vc5-m9fg is a vulnerability in github.com/foxcpp/maddy, published on 12 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module and an extremely outdated system that still allows MD5 hashes in /etc/shadows.
Patches
Patch is available as part of the 0.5.2 release.
Workarounds
Ensure MD5 hashes are not present in /etc/shadow.
Which versions are affected by GHSA-qh54-9vc5-m9fg?
3 open source packages ship an affected version, including github.com/foxcpp/maddy.
| Package | Affected | Fixed in |
|---|---|---|
github.com/foxcpp/maddy Go | From 0.5.0 | 0.5.2 |
github.com/foxcpp/maddy Go | From 0.5.0 | 0.5.2 |
github.com/foxcpp/maddy Go | From 0.5.0 | 0.5.2 |
How do I fix GHSA-qh54-9vc5-m9fg?
Upgrade github.com/foxcpp/maddy to 0.5.2 or later.
Is GHSA-qh54-9vc5-m9fg being exploited?
There is no known exploitation of GHSA-qh54-9vc5-m9fg in the wild and no public exploit code.
Sources
Also known as GO-2022-0378.