[JAMES-2240] Use of MD5 for checksum to index email body

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: master
• Component/s: James Core
• Assignee: Unassigned
• Reporter: Thibaut SAUTEREAU
• Created: 28/Nov/17 07:23
• Updated: 30/Nov/17 02:51
• Resolved: 30/Nov/17 02:51

Description

In the MBoxMailRepository class, the generateKeyValue() function uses MD5 to compute a key, which is supposed to be unique in order to then index every single email body.

However, MD5 is vulnerable to lots of collisions and an attacker could manage to replace (understand "overwrite") an existing indexed email body by another one, leading to many potential abuses.

A more cryptographically secure hash function such as SHA-256 or SHA-512 should be used instead.