PT-2024-23109 · Serverpod · Serverpod

Published 2024-03-27 · Updated 2026-01-08 · CVE-2024-29886

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Serverpod versions prior to 1.2.6

Description An issue was identified with the old password hash algorithm used by Serverpod, making it susceptible to rainbow attacks if the database was compromised. The vulnerability is addressed by switching to the OWASP-recommended Argon2Id password hash algorithm.

Recommendations For versions prior to 1.2.6, upgrade to version 1.2.6 to resolve the issue. To migrate existing password hashes, call the Emails.migrateLegacyPasswordHashes() function with a session instance as an argument. This method can be implemented as part of starting the server or by creating a web server route that can be called remotely.

Exploit

Fix

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2024-29886

GHSA-R75M-26CQ-MJXC

Affected Products

Serverpod

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29886.json · Exploit
• https://github.com/serverpod/serverpod/commit/a78b9e9f1de74d1300633a122b6cc0f064139ad6 · Patch
• https://github.com/serverpod/serverpod/security/advisories/GHSA-r75m-26cq-mjxc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29886 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29886 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r75m-26cq-mjxc · Vendor Advisory
• https://github.com/serverpod/serverpod · Note
• https://twitter.com/RsSI47041968/status/1824490699099869432 · Twitter Post
• https://t.me/cvenotify/74886 · Telegram Post
• https://twitter.com/RedPacketSec/status/1773655268275986881 · Twitter Post
• https://t.me/cveNotify/148112 · Telegram Post
• https://twitter.com/CVEnew/status/1773096334238855315 · Twitter Post