CVE-2024-47182
highpriority · track · 30EPSS 0.002 · 11 %ileDEEUUSEPSS · scored 2026-10-26
Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedgovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedgovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedgovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedgovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedgovulncheck-vulndb-0.0.20241104T154416-5.1.noarch as component of SUSE Package Hub 12suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.8–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- SUSE-SU-2024:3911-1Security update for govulncheck-vulndb2024-11-05csaf · suse_csafDE
Security update for govulncheck-vulndb
- openSUSE-SU-2024:0350-1Security update for govulncheck-vulndb2024-11-05csaf · suse_csafDE
Security update for govulncheck-vulndb
- GHSA-w7qr-q9fh-fj35Dozzle uses unsafe hash for passwords2024-10-09ghsa · osvUS
### Summary The app uses sha-256 as the hash for passwords. The app should switch to bcrypt. ### Details SHA-256 is a message digest hash, and not classified as secure for password hashing. Message digest hashes are designed to be fast, while password hashing mechanisms are designed with certain cryptographic properties (e.g. slow) to protect against vulnerabilities. Refer to the links below for more information: - https://security.stackexchange.com/questions/195563/why-is-sha-256-not-good-for-passwords - https://stackoverflow.com/questions/11624372/best-practice-for-hashing-passwords-sha256-or-sha512 - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords-with-bcrypt ### PoC N/A ### Impact It leaves users susceptible to rainbow table attacks
- GO-2024-3163Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle2024-10-09vendor · osvUS
Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/amir20/dozzle before v8.5.3.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-47182/cnnvd
- https://github.com/amir20/dozzle/commit/de79f03aa3dbe5bb1e154a7e8d3dccbd229f3ea3cnnvd
- https://github.com/amir20/dozzle/releases/tag/v8.5.3Patchcnnvd
- https://github.com/amir20/dozzle/security/advisories/GHSA-w7qr-q9fh-fj35cnnvd
- https://github.com/amir20/dozzle/commit/de79f03aa3dbe5bb1e154a7e8d3dccbd229f3ea3enisa_euvd
- https://github.com/amir20/dozzle/security/advisories/GHSA-w7qr-q9fh-fj35enisa_euvd
- https://github.com/amir20/dozzle/commit/de79f03aa3dbe5bb1e154a7e8d3dccbd229f3ea3Patchnvd
- https://github.com/amir20/dozzle/security/advisories/GHSA-w7qr-q9fh-fj35Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan