[jira] [Commented] (KYLIN-4478) Usage of "AES/ECB/PKCS5Padding" is insecure

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KYLIN-4478?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17126536#comment-17126536 ] 

ASF GitHub Bot commented on KYLIN-4478:
---------------------------------------

nichunen closed pull request #1193:
URL: https://github.com/apache/kylin/pull/1193


   


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


> Usage of "AES/ECB/PKCS5Padding" is insecure
> -------------------------------------------
>
>                 Key: KYLIN-4478
>                 URL: https://issues.apache.org/jira/browse/KYLIN-4478
>             Project: Kylin
>          Issue Type: Improvement
>            Reporter: Md Mahir Asef Kabir
>            Assignee: Md Mahir Asef Kabir
>            Priority: Major
>             Fix For: v3.1.0
>
>
> *Vulnerability Description:* In “core-common/src/main/java/org/apache/kylin/common/util/EncryptUtil.java” file the following code was written in public static String encrypt(String strToEncrypt) method - 
> {code:java}
> Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
> {code}
> The vulnerability is, using "AES/ECB/PKCS5Padding” as the argument to Cipher.getInstance method.
> *Reason it’s vulnerable:* ”AES/ECB/PKCS5Padding” is not secure. For further reference, follow [this|https://zachgrace.com/posts/attacking-ecb/].
> *Suggested Fix:* Using 
> {code:java}
> Cipher cipher = Cipher.getInstance("AES/CFB/PKCS5Padding");
> {code}
> *Feedback:* Please select any of the options down below to help us get an idea about how you felt about the suggestion - 
> # Liked it and will make the suggested changes
> # Liked it but happy with the existing version
> # Didn’t find the suggestion helpful



--
This message was sent by Atlassian Jira
(v8.3.4#803005)