Uploaded image for project: 'Jackrabbit Content Repository'
  1. Jackrabbit Content Repository
  2. JCR-4115

Don't use SHA-1 for new DataStore binaries (Jackrabbit)

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 2.16, 2.15.1, 2.14.2
    • Component/s: None
    • Labels:
      None

      Description

      A collision for SHA-1 has been published. We still use SHA-1 for the FileDataStore, and I believe the S3 DataStore right now. Given there is a collision, we should switch to a stronger algorithm, for example SHA-256, for new binaries.

        Attachments

        1. JCR-4115c.patch
          8 kB
          Amit Jain
        2. JCR-4115b.patch
          6 kB
          Thomas Mueller
        3. JCR-4115.patch
          3 kB
          Thomas Mueller

        Issue Links

          Activity

            People

            • Assignee:
              amitjain Amit Jain
              Reporter:
              thomasm Thomas Mueller

              Dates

              • Created:
                Updated:
                Resolved:

                Issue deployment