Bug 30594 - Package Crypt::CBC 2.35 or higher to increase security
Summary: Package Crypt::CBC 2.35 or higher to increase security
Status: In Discussion
Alias: None
Product: Koha
Classification: Unclassified
Component: Packaging (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 28998
Blocks:
  Show dependency treegraph
 
Reported: 2022-04-22 09:21 UTC by Martin Renvoize
Modified: 2023-04-05 06:11 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2022-04-22 09:21:43 UTC
Currently, Debian mostly comes with Crypt::CBC 2.33 pre-packaged.  If we package 2.35 or above we can benefit from a performance boost as well as having the ability to update our derivation function to using the recommended pbkdf2 algorithm instead of the backwards compatible default of opensslv1.

If we choose to package this, we should also update Koha::Encryption to reflect the change and use pbkdf2.
Comment 1 Mason James 2023-04-05 06:11:56 UTC
(In reply to Martin Renvoize from comment #0)
> Currently, Debian mostly comes with Crypt::CBC 2.33 pre-packaged.  If we
> package 2.35 or above we can benefit from a performance boost as well as
> having the ability to update our derivation function to using the
> recommended pbkdf2 algorithm instead of the backwards compatible default of
> opensslv1.
> 
> If we choose to package this, we should also update Koha::Encryption to
> reflect the change and use pbkdf2.

hiya, we now have libcrypt-cbc-perl (3.04-3) added to koha-staging/dev repo

so we can proceed with an upgrade to pbkdf2

https://packages.debian.org/bookworm/libcrypt-cbc-perl