Use a more secure hashing algorithm
Closed this issue · 1 comments
marcovisserFurore commented
In Firely.Fhir.Packages/Firely.Fhir.Packages/Tar/CheckSum.cs
, SHA1 is used to calculate a checksum:
public static byte[] ShaSum(byte[] buffer)
{
using var sha = SHA1.Create();
var hash = sha.ComputeHash(buffer);
return hash;
}
Use a secure hashing algorithm, such as SHA2 or SHA3.
This issue is coming from a security analysis of the code. (https://dashboard.inline.securify.nl/findings/b0e622b4-61d2-4889-7982-08dab1d421c0?w=large)
mmsmits commented
Simplifier implements their own ShaSum, this code will be removed from the package library in the next major version and is now marked obsolete