CVE-2024-47182: Dozzle uses unsafe hash for passwords

October 9, 2024

The app uses sha-256 as the hash for passwords. The app should switch to bcrypt.

References

github.com/advisories/GHSA-w7qr-q9fh-fj35
github.com/amir20/dozzle
github.com/amir20/dozzle/commit/de79f03aa3dbe5bb1e154a7e8d3dccbd229f3ea3
github.com/amir20/dozzle/security/advisories/GHSA-w7qr-q9fh-fj35
nvd.nist.gov/vuln/detail/CVE-2024-47182
pkg.go.dev/vuln/GO-2024-3163

Code Behaviors & Features

Detect and mitigate CVE-2024-47182 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →