FirelyTeam/Firely.Fhir.Packages

Use a more secure hashing algorithm

Closed this issue · 1 comments

In Firely.Fhir.Packages/Firely.Fhir.Packages/Tar/CheckSum.cs, SHA1 is used to calculate a checksum:

public static byte[] ShaSum(byte[] buffer)
{
    using var sha = SHA1.Create();
    var hash = sha.ComputeHash(buffer);
    return hash;
}

Use a secure hashing algorithm, such as SHA2 or SHA3.

This issue is coming from a security analysis of the code. (https://dashboard.inline.securify.nl/findings/b0e622b4-61d2-4889-7982-08dab1d421c0?w=large)

Simplifier implements their own ShaSum, this code will be removed from the package library in the next major version and is now marked obsolete