Bug 30594

Summary: Package Crypt::CBC 2.35 or higher to increase security
Product: Koha Reporter: Martin Renvoize <martin.renvoize>
Component: PackagingAssignee: Bugs List <koha-bugs>
Status: In Discussion --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: mtj
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 28998    
Bug Blocks:    

Description Martin Renvoize 2022-04-22 09:21:43 UTC
Currently, Debian mostly comes with Crypt::CBC 2.33 pre-packaged.  If we package 2.35 or above we can benefit from a performance boost as well as having the ability to update our derivation function to using the recommended pbkdf2 algorithm instead of the backwards compatible default of opensslv1.

If we choose to package this, we should also update Koha::Encryption to reflect the change and use pbkdf2.
Comment 1 Mason James 2023-04-05 06:11:56 UTC
(In reply to Martin Renvoize from comment #0)
> Currently, Debian mostly comes with Crypt::CBC 2.33 pre-packaged.  If we
> package 2.35 or above we can benefit from a performance boost as well as
> having the ability to update our derivation function to using the
> recommended pbkdf2 algorithm instead of the backwards compatible default of
> opensslv1.
> 
> If we choose to package this, we should also update Koha::Encryption to
> reflect the change and use pbkdf2.

hiya, we now have libcrypt-cbc-perl (3.04-3) added to koha-staging/dev repo

so we can proceed with an upgrade to pbkdf2

https://packages.debian.org/bookworm/libcrypt-cbc-perl