{"id":"GHSA-qh54-9vc5-m9fg","aliases":["GO-2022-0378"],"status":"published","title":"MD5 hash support in github.com/foxcpp/maddy","description":"### Impact\n\nThis vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module\nand an extremely outdated system that still allows MD5 hashes in \n/etc/shadows.\n\n### Patches\n\nPatch is available as part of the 0.5.2 release.\n\n### Workarounds\n\nEnsure MD5 hashes are not present in /etc/shadow.","severity":{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-261"],"published":"2021-10-12T16:06:30Z","modified":"2026-03-03T04:50:10Z","fixes":[{"ecosystem":"Go","package":"github.com/foxcpp/maddy","fixed_in":["0.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/foxcpp/maddy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/foxcpp/maddy","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/foxcpp/maddy","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.0"},{"fixed":"0.5.2"}]}]}],"references":[{"url":"https://github.com/foxcpp/maddy/security/advisories/GHSA-qh54-9vc5-m9fg","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qh54-9vc5-m9fg"},{"url":"https://github.com/foxcpp/maddy","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-qh54-9vc5-m9fg","title":"MD5 hash support in github.com/foxcpp/maddy","description":"### Impact\n\nThis vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module\nand an extremely outdated system that still allows MD5 hashes in \n/etc/shadows.\n\n### Patches\n\nPatch is available as part of the 0.5.2 release.\n\n### Workarounds\n\nEnsure MD5 hashes are not present in /etc/shadow.\n","status":"published","published":"2021-10-12T16:06:30Z","modified":"2023-01-09T05:05:03Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-261"],"updated_at":"2026-11-02T14:36:11.367194Z"}],"osv":[{"id":"GHSA-qh54-9vc5-m9fg","title":"MD5 hash support in github.com/foxcpp/maddy","description":"### Impact\n\nThis vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module\nand an extremely outdated system that still allows MD5 hashes in \n/etc/shadows.\n\n### Patches\n\nPatch is available as part of the 0.5.2 release.\n\n### Workarounds\n\nEnsure MD5 hashes are not present in /etc/shadow.\n","status":"published","published":"2021-10-12T16:06:30Z","modified":"2024-08-21T14:57:07.494061Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-261"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"GO-2022-0378","title":"MD5 hash support in github.com/foxcpp/maddy","description":"MD5 hash support in github.com/foxcpp/maddy","status":"published","published":"2024-08-21T14:30:31Z","modified":"2026-03-03T04:50:10.914141Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}