[KYLIN-4479] Usage of "AES/ECB/PKCS5Padding" is insecure

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Assignee: Unassigned
• Reporter: Md Mahir Asef Kabir
• Created: 04/May/20 02:11
• Updated: 14/May/20 07:09
• Resolved: 14/May/20 07:09

Description

Vulnerability Description: In “core-common/src/main/java/org/apache/kylin/common/util/EncryptUtil.java” file the following code was written in public static String encrypt(String strToEncrypt) method & public static String decrypt(String strToDecrypt) method -

Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");

The vulnerability is, using "AES/ECB/PKCS5Padding” as the argument to Cipher.getInstance method.

Reason it’s vulnerable: ”AES/ECB/PKCS5Padding” is not secure. For further reference, please follow this .

Suggested Fix: Using

Cipher cipher = Cipher.getInstance("AES/CFB/PKCS5Padding");

Feedback: Please select any of the options down below to help us get an idea about how you felt about the suggestion -

1. Liked it and will make the suggested changes
2. Liked it but happy with the existing version
3. Didn’t find the suggestion helpful

Issue Links

• duplicates: KYLIN-4478 Usage of "AES/ECB/PKCS5Padding" is insecure