CVE-2024-41259: Navidrome uses MD5 hashing algorithm

August 1, 2024 (updated August 2, 2024)

Use of insecure hashing algorithm in the Gravatar’s service in Navidrome v0.52.3 allows attackers to manipulate a user’s account information.

References

gist.github.com/nyxfqq/d192af10b53a363e2d9e430068333e04
github.com/advisories/GHSA-hrmx-8jjv-g758
github.com/navidrome/navidrome
nvd.nist.gov/vuln/detail/CVE-2024-41259

Code Behaviors & Features

Detect and mitigate CVE-2024-41259 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →