apache / apache/logging-log4j2
Update encryption algorithms in Flume appender
- Dominant language
- Java
- Stars
- 3.6k
- Forks
- 1.7k
- Avg merge
- 21h 30m
- Merged PRs (30d)
- 27
Description
## Description
The Flume appender uses:
```java
Cipher.getInstance("AES");
```
to encrypt messages
In the default [Oracle security providers](https://docs.oracle.com/en/java/javase/17/security/oracle-providers.html#GUID-BC92B7F1-D15C-432A-B725-9BBA9FEF61DB) this uses `ECB` as cipher mode, which:
- does not provide integrity (cf. [CIPHER_INTEGRITY](https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY)),
- does not provide good confidentiality (cf. [ECB_MODE](https://find-sec-bugs.github.io/bugs.htm#ECB_MODE)).
If Flume supports it, we should replace it with another cipher mode.
Related to #1707.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.