[Bug 30594] New: Package Crypt::CBC 2.35 or higher to increase security
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30594 Bug ID: 30594 Summary: Package Crypt::CBC 2.35 or higher to increase security Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Packaging Assignee: koha-bugs@lists.koha-community.org Reporter: martin.renvoize@ptfs-europe.com QA Contact: testopia@bugs.koha-community.org CC: mtj@kohaaloha.com Currently, Debian mostly comes with Crypt::CBC 2.33 pre-packaged. If we package 2.35 or above we can benefit from a performance boost as well as having the ability to update our derivation function to using the recommended pbkdf2 algorithm instead of the backwards compatible default of opensslv1. If we choose to package this, we should also update Koha::Encryption to reflect the change and use pbkdf2. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30594 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |28998 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 [Bug 28998] Encrypt borrowers.secret -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30594 Bug 30594 depends on bug 28998, which changed state. Bug 28998 Summary: Encrypt borrowers.secret https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28998 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30594 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |In Discussion --- Comment #1 from Mason James <mtj@kohaaloha.com> --- (In reply to Martin Renvoize from comment #0)
Currently, Debian mostly comes with Crypt::CBC 2.33 pre-packaged. If we package 2.35 or above we can benefit from a performance boost as well as having the ability to update our derivation function to using the recommended pbkdf2 algorithm instead of the backwards compatible default of opensslv1.
If we choose to package this, we should also update Koha::Encryption to reflect the change and use pbkdf2.
hiya, we now have libcrypt-cbc-perl (3.04-3) added to koha-staging/dev repo so we can proceed with an upgrade to pbkdf2 https://packages.debian.org/bookworm/libcrypt-cbc-perl -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30594 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #2 from David Cook <dcook@prosentient.com.au> --- This would be a nice one to revisit. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30594 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=40009 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org