{"id":"GHSA-g636-q5fc-4pr7","aliases":[],"status":"published","title":"accounts: Hash account number using Salt","description":"@alovak found that currently when we build hash of account number we do not \"salt\" it. Which makes it vulnerable to rainbow table attack.\n\n**What did you expect to see?**\nI expected salt (some random number from configuration) to be used in [hash.AccountNumber](https://github.com/moov-io/customers/blob/master/pkg/secrets/hash/account_number.go#L13)\n\nI would generate salt per tenant at least (maybe per organization).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-05-24T17:00:27Z","modified":"2023-01-09T05:04:35Z","fixes":[{"ecosystem":"Go","package":"github.com/moov-io/customers","fixed_in":["0.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/moov-io/customers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/moov-io/customers","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.0"}]}]}],"references":[{"url":"https://github.com/moov-io/customers/security/advisories/GHSA-g636-q5fc-4pr7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g636-q5fc-4pr7"}],"sources":{"ghsa":[{"id":"GHSA-g636-q5fc-4pr7","title":"accounts: Hash account number using Salt","description":"@alovak found that currently when we build hash of account number we do not \"salt\" it. Which makes it vulnerable to rainbow table attack.\n\n**What did you expect to see?**\nI expected salt (some random number from configuration) to be used in [hash.AccountNumber](https://github.com/moov-io/customers/blob/master/pkg/secrets/hash/account_number.go#L13)\n\nI would generate salt per tenant at least (maybe per organization).","status":"published","published":"2021-05-24T17:00:27Z","modified":"2023-01-09T05:04:35Z","updated_at":"2026-11-02T14:36:10.502376Z"}],"osv":[{"id":"GHSA-g636-q5fc-4pr7","title":"accounts: Hash account number using Salt","description":"@alovak found that currently when we build hash of account number we do not \"salt\" it. Which makes it vulnerable to rainbow table attack.\n\n**What did you expect to see?**\nI expected salt (some random number from configuration) to be used in [hash.AccountNumber](https://github.com/moov-io/customers/blob/master/pkg/secrets/hash/account_number.go#L13)\n\nI would generate salt per tenant at least (maybe per organization).","status":"published","published":"2021-05-24T17:00:27Z","modified":"2021-05-21T22:11:53Z","updated_at":"2026-11-02T15:46:47.472172Z"}]}}