{"id":"GHSA-g636-q5fc-4pr7","summary":"accounts: Hash account number using Salt","details":"@alovak found that currently when we build hash of account number we do not \"salt\" it. Which makes it vulnerable to rainbow table attack.\n\n**What did you expect to see?**\nI expected salt (some random number from configuration) to be used in [hash.AccountNumber](https://github.com/moov-io/customers/blob/master/pkg/secrets/hash/account_number.go#L13)\n\nI would generate salt per tenant at least (maybe per organization).","modified":"2021-05-21T22:11:53Z","published":"2021-05-24T17:00:27Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2021-05-21T22:11:53Z","nvd_published_at":null,"cwe_ids":[]},"references":[{"type":"WEB","url":"https://github.com/moov-io/customers/security/advisories/GHSA-g636-q5fc-4pr7"}],"affected":[{"package":{"name":"github.com/moov-io/customers","ecosystem":"Go","purl":"pkg:golang/github.com/moov-io/customers"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-g636-q5fc-4pr7/GHSA-g636-q5fc-4pr7.json"}}],"schema_version":"1.9.0"}