Summary: | Package Crypt::CBC 2.35 or higher to increase security | ||
---|---|---|---|
Product: | Koha | Reporter: | Martin Renvoize (ashimema) <martin.renvoize> |
Component: | Packaging | Assignee: | Bugs List <koha-bugs> |
Status: | In Discussion --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | mtj |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Bug Depends on: | 28998 | ||
Bug Blocks: |
Description
Martin Renvoize (ashimema)
2022-04-22 09:21:43 UTC
(In reply to Martin Renvoize from comment #0) > Currently, Debian mostly comes with Crypt::CBC 2.33 pre-packaged. If we > package 2.35 or above we can benefit from a performance boost as well as > having the ability to update our derivation function to using the > recommended pbkdf2 algorithm instead of the backwards compatible default of > opensslv1. > > If we choose to package this, we should also update Koha::Encryption to > reflect the change and use pbkdf2. hiya, we now have libcrypt-cbc-perl (3.04-3) added to koha-staging/dev repo so we can proceed with an upgrade to pbkdf2 https://packages.debian.org/bookworm/libcrypt-cbc-perl |