amir20 dozzle up to 8.5.2 weak hash

Summaryinfo

A vulnerability was found in amir20 dozzle up to 8.5.2. It has been classified as problematic. This affects an unknown part. This manipulation causes weak hash. This vulnerability is handled as CVE-2024-47182. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in amir20 dozzle up to 8.5.2. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a weak hash vulnerability. The CWE definition for the vulnerability is CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). As an impact it is known to affect confidentiality, and integrity. The summary by CVE is:

Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-47182 since 09/20/2024. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 210390 (SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2024:3911-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 8.5.3 eliminates this vulnerability. Applying the patch de79f03aa3dbe5bb1e154a7e8d3dccbd229f3ea3 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (210390). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• amir20

Name

• dozzle

Version

• 8.5.0
• 8.5.1
• 8.5.2

License

• open-source

Website

• Product: https://github.com/amir20/dozzle/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion