Weak Hashing Algorithm

MD5 and SHA1 are weak hashing algorithms and open to collision attacks. They are not suitable for cryptographic signature.

Remediation

At the time of writing, SHA3 is recommended. Best to use a slow hashing algorithm like bcrypt.
Ensure that the design allows one hashing algorithm to be replaced with another.

Metadata

Severity: low
Slug: weak-hashing-algorithm

CWEs

916: Use of Password Hash With Insufficient Computational Effort
327: Use of a Broken or Risky Cryptographic Algorithm
328: Use of Weak Hash

OWASP

A02:2021: Cryptographic Failures

Available Labs

Open Java labs in SecDim Play for this vulnerability.

medium

Bad password.java

Java Medium Signature

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.