Use of Weak Hash Affecting github.com/beego/beego/v2/client/cache package, versions <2.3.4
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMBEEGOBEEGOV2CLIENTCACHE-8501371
- published13 Dec 2024
- disclosed12 Dec 2024
- creditkexinoh
Introduced: 12 Dec 2024
NewCVE-2024-55885 Â (opens in a new tab)How to fix?
Upgrade github.com/beego/beego/v2/client/cache to version 2.3.4 or higher.
Overview
Affected versions of this package are vulnerable to Use of Weak Hash due to the use of MD5 for generating filenames from cache keys. An attacker can manipulate cache data or gain unauthorized access to sensitive information by crafting a key that results in the same MD5 hash as another valid key.
Note:
This is only exploitable if an attacker can predict or control the input to the MD5 hash function used for generating cache filenames.
Workaround
This vulnerability can be mitigated by replacing MD5 with a more secure hash function like SHA-256, which has a significantly lower probability of collisions and is resistant to known attack vectors.