{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/moov-io/customers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-21T22:11:53Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "@alovak found that currently when we build hash of account number we do not \"salt\" it. Which makes it vulnerable to rainbow table attack.\n\n**What did you expect to see?**\nI expected salt (some random number from configuration) to be used in [hash.AccountNumber](https://github.com/moov-io/customers/blob/master/pkg/secrets/hash/account_number.go#L13)\n\nI would generate salt per tenant at least (maybe per organization).",
  "id": "GHSA-g636-q5fc-4pr7",
  "modified": "2021-05-21T22:11:53Z",
  "published": "2021-05-24T17:00:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/moov-io/customers/security/advisories/GHSA-g636-q5fc-4pr7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "accounts: Hash account number using Salt"
}