Bug 30594 - Package Crypt::CBC 2.35 or higher to increase security
Summary: Package Crypt::CBC 2.35 or higher to increase security
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Packaging (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 28998
Blocks:
  Show dependency treegraph
 
Reported: 2022-04-22 09:21 UTC by Martin Renvoize
Modified: 2022-04-22 09:21 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2022-04-22 09:21:43 UTC
Currently, Debian mostly comes with Crypt::CBC 2.33 pre-packaged.  If we package 2.35 or above we can benefit from a performance boost as well as having the ability to update our derivation function to using the recommended pbkdf2 algorithm instead of the backwards compatible default of opensslv1.

If we choose to package this, we should also update Koha::Encryption to reflect the change and use pbkdf2.