MD5 hash support in github.com/foxcpp/maddy

published 2021-10-12 5y ago modified 2026-03-03 8mo ago also GO-2022-0378

cvss: 3.0; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact

This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module and an extremely outdated system that still allows MD5 hashes in /etc/shadows.

### Patches

Patch is available as part of the 0.5.2 release.

### Workarounds

Ensure MD5 hashes are not present in /etc/shadow.

Patch / fix

fixed in 1

go github.com/foxcpp/maddy 0.5.2

Is GHSA-qh54-9vc5-m9fg in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	3.0	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/foxcpp/maddy	>=0.5.0, <0.5.2	0.5.2

Classification

Weakness

CWE-261 Weak Encoding for Password

References

github.com /foxcpp/maddy/security/advisories/GHSA-qh54-9vc5-m9fg
web, advisory
github.com /foxcpp/maddy
package

Sources

GitHub Advisory GHSA-qh54-9vc5-m9fg
OSV GO-2022-0378

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.