Usage of weak hashing library on a password (MD5)

• Rule ID: python_lang_weak_password_encryption_md5
• Languages: python
• Source: weak_password_encryption_md5.yml

Description

Using a weak hashing library like MD5 for passwords increases the risk of data breaches. MD5 is vulnerable to collision attacks, where two different inputs can produce the same hash value, compromising data integrity and security.

Remediations

• Do not use MD5 for hashing passwords as it is considered weak and vulnerable to attacks.

  hashlib.md5(user.password).digest() # unsafe

• Do opt for stronger hashing algorithms such as SHA-256 to enhance security.

  hashlib.sha256(user.password).digest()

Associated CWE

• CWE-326: Inadequate Encryption Strength

OWASP Top 10

• A02:2021 - Cryptographic Failures

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=python_lang_weak_password_encryption_md5

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=python_lang_weak_password_encryption_md5