{"id":"GHSA-g636-q5fc-4pr7","aliases":[],"url":"https://o3.security/vulnerability/GHSA-g636-q5fc-4pr7","summary":"accounts: Hash account number using Salt","details":"@alovak found that currently when we build hash of account number we do not \"salt\" it. Which makes it vulnerable to rainbow table attack.\n\n**What did you expect to see?**\nI expected salt (some random number from configuration) to be used in [hash.AccountNumber](https://github.com/moov-io/customers/blob/master/pkg/secrets/hash/account_number.go#L13)\n\nI would generate salt per tenant at least (maybe per organization).","published":"2021-05-24T17:00:27Z","modified":"2021-05-21T22:11:53Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/moov-io/customers","fixedVersion":"0.5.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/moov-io/customers/security/advisories/GHSA-g636-q5fc-4pr7"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2021-05-21T22:11:53Z"}}