| Summary: | Package Crypt::CBC 2.35 or higher to increase security | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Martin Renvoize (ashimema) <martin.renvoize> |
| Component: | Packaging | Assignee: | Bugs List <koha-bugs> |
| Status: | In Discussion --- | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | dcook, mtj |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40009 | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | 28998 | ||
| Bug Blocks: | |||
|
Description
Martin Renvoize (ashimema)
2022-04-22 09:21:43 UTC
(In reply to Martin Renvoize from comment #0) > Currently, Debian mostly comes with Crypt::CBC 2.33 pre-packaged. If we > package 2.35 or above we can benefit from a performance boost as well as > having the ability to update our derivation function to using the > recommended pbkdf2 algorithm instead of the backwards compatible default of > opensslv1. > > If we choose to package this, we should also update Koha::Encryption to > reflect the change and use pbkdf2. hiya, we now have libcrypt-cbc-perl (3.04-3) added to koha-staging/dev repo so we can proceed with an upgrade to pbkdf2 https://packages.debian.org/bookworm/libcrypt-cbc-perl This would be a nice one to revisit. |