Appdynamics / Appdynamics/Sample-Android-Application

MD5 is a weak hash known to have hash collisions.

未关闭
#1 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Kotlin
星标
0
派生
1
PR 合并指标
30 天内没有已合并 PR

描述

Dear AppDynamics Security Team,

I am writing to report a security vulnerability identified in our codebase that involves the usage of the MD5 hash function.
The vulnerability associated with the MD5 hash function is that it is susceptible to hash collisions, which occur when two different input values produce the same hash value. This makes it possible for attackers to create malicious data that has the same hash as legitimate data, allowing them to bypass security measures and potentially cause harm.

Affected Path:

com/appdynamics/eumagent/runtime/p000private/bg.java

com/downloader/utils/Utils.java com/itextpdf/text/ImgJBIG2.java

com/itextpdf/text/pdf/PdfEncryption.java com/itextpdf/text/pdf/PdfSmartCopy.java

**Additional Context:** This issue was discovered during an internal security audit, and we wanted to bring it to your attention for review and remediation.

If you require further details or technical support regarding this report, please feel free to reach out.

Thank you,
MBRHE

贡献指南

这个仓库没有索引到贡献指南

调研方向

首先检查 com/appdynamics/eumagent/runtime/p000private/bg.java、com/downloader/utils/Utils.java 以及列出的 iText PDF 文件中的 MD5 使用情况。确定哪些使用会影响安全敏感行为,并为每条路径确定适当的修复方案。Done 应处理所有报告的 MD5 使用,同时不破坏受影响 Android 应用程序的行为。

由索引模型根据 Issue 内容生成。

评估

技术栈
android, java, kotlin
领域
cryptography, mobile, security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
需要澄清
新手友好度
25/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。