It looks like the koha-reset-passwd script still uses MD5 instead of Bcrypt. This should probably be updated so as to prevent unnecessary use of weak password hashes.
*** This bug has been marked as a duplicate of bug 17746 ***