SG-039: Weak Cryptography

Severity: LOW

MD5/SHA1/DES/RC4 in cryptographic context

Fires when

• Python hashlib.md5 / hashlib.sha1 is called
• PyCrypto MD5 / SHA1 hashes or the broken DES / RC4 ciphers are used
• Node crypto createHash / createHmac is called with 'md5' or 'sha1'
• Java MessageDigest.getInstance requests MD5 or SHA-1

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.