CVE-2024-47182: Dozzle uses unsafe hash for passwords

October 9, 2024

The app uses sha-256 as the hash for passwords. The app should switch to bcrypt.

References

github.com/advisories/GHSA-w7qr-q9fh-fj35
github.com/amir20/dozzle
github.com/amir20/dozzle/commit/de79f03aa3dbe5bb1e154a7e8d3dccbd229f3ea3
github.com/amir20/dozzle/security/advisories/GHSA-w7qr-q9fh-fj35
nvd.nist.gov/vuln/detail/CVE-2024-47182
pkg.go.dev/vuln/GO-2024-3163

Detect and mitigate CVE-2024-47182 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →