Vulnerability · Published Dec 12, 2024 · Assigned by GitHub_M

CVE-2024-55885Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenames

Medium 6.9

In plain English

A medium-severity broken cryptography in beego from beego. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.3%top 71.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/beego/beego	no fix listed	GHSA-9j3m-fr7q-jxfw
Go	github.com/beego/beego	no fix listed	GO-2024-3331
Go	github.com/beego/beego/v2	2.3.4	GHSA-9j3m-fr7q-jxfw
Go	github.com/beego/beego/v2	2.3.4	GO-2024-3331

Affected products (as reported)

Vendor	Product	Versions
beego	beego	< 2.3.4

Weakness: CWE-328, CWE-327 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/beego/beego/security/advisories/GHSA-9j3m-fr7q-jxfw x_refsource_CONFIRM
https://github.com/beego/beego/commit/e7fa4835f71f47ab1d13afd638cebf661800d5a4 x_refsource_MISC