New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[master] JCEEncryptor default encryption algorithm upgrade #2004

Merged

rfelcman merged 10 commits into eclipse-ee4j:master from rfelcman:encryptor_upgrade

Dec 1, 2023

Merged

[master] JCEEncryptor default encryption algorithm upgrade #2004

Code cleanup

GitHub Advanced Security / CodeQL failed Dec 1, 2023 in 3s

5 new alerts including 5 high severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

5 high

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 60 in foundation/org.eclipse.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java

Code scanning / CodeQL

Using a static initialization vector for encryption High

A

static initialization vector

should not be used for encryption.

Check failure on line 51 in foundation/org.eclipse.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java

Code scanning / CodeQL

Use of a broken or risky cryptographic algorithm High

Cryptographic algorithm

DES/ECB/PKCS5Padding

is weak and should not be used.

Check failure on line 54 in foundation/org.eclipse.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java

Code scanning / CodeQL

Use of a broken or risky cryptographic algorithm High

Cryptographic algorithm

AES/ECB/PKCS5Padding

is weak and should not be used.

Check failure on line 59 in foundation/org.eclipse.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java

Code scanning / CodeQL

Use of a broken or risky cryptographic algorithm High

Cryptographic algorithm

AES/CBC/PKCS5Padding

is weak and should not be used.

Check failure on line 138 in foundation/org.eclipse.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java

Code scanning / CodeQL

Use of a broken or risky cryptographic algorithm High

Cryptographic algorithm

DES

is weak and should not be used.