openSUSE / openSUSE/supportutils
Usage of deprecated MD5 hash function
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 35
- Forks
- 70
- Avg merge
- 5d 16h
- Merged PRs (30d)
- 1
Description
I noticed that supportutils is still using MD5 as a hash function in several places. Practical real-world collision attacks against MD5 have been known to the general public for more than 15 years now.
While this is not directly a vulnerability, given the scope of its use in supportutils, it still would be better to replace MD5 with a modern hash function such as SHA256 or better.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by searching the supportutils source for every use of the MD5 hash function and inspect how each digest is used. Determine a suitable modern replacement for each use, then verify that all affected utilities still gather system information correctly and that no MD5 uses remain where a stronger hash is appropriate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- shell
- Domain
- security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100