[prev in list] [next in list] [prev in thread] [next in thread] 

List:       james-dev
Subject:    [jira] [Resolved] (JAMES-2240) Use of MD5 for checksum to index email body
From:       "Tellier Benoit (JIRA)" <server-dev () james ! apache ! org>
Date:       2017-11-30 2:52:00
Message-ID: JIRA.13121205.1511853806000.352163.1512010320208 () Atlassian ! JIRA
[Download RAW message or body]


     [ https://issues.apache.org/jira/browse/JAMES-2240?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel \
]

Tellier Benoit resolved JAMES-2240.
-----------------------------------
    Resolution: Fixed

https://github.com/linagora/james-project/pull/1156 solved the issue

> Use of MD5 for checksum to index email body
> -------------------------------------------
> 
> Key: JAMES-2240
> URL: https://issues.apache.org/jira/browse/JAMES-2240
> Project: James Server
> Issue Type: Bug
> Components: James Core
> Affects Versions: master
> Reporter: Thibaut SAUTEREAU
> 
> In the MBoxMailRepository class, the generateKeyValue() function uses MD5 to \
> compute a key, which is supposed to be unique in order to then index every single \
> email body. However, MD5 is vulnerable to lots of collisions and an attacker could \
> manage to replace (understand "overwrite") an existing indexed email body by \
> another one, leading to many potential abuses. A more cryptographically secure hash \
> function such as SHA-256 or SHA-512 should be used instead.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org


[prev in list] [next in list] [prev in thread] [next in thread]