Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update library used to generate IDs in the Report constructor to be FIPS compliant #174798

Closed
kc13greiner opened this issue Jan 12, 2024 · 2 comments · Fixed by #174809
Closed

Update library used to generate IDs in the Report constructor to be FIPS compliant #174798

kc13greiner opened this issue Jan 12, 2024 · 2 comments · Fixed by #174809
Assignees
@eokoneyo
Labels
Feature:FIPS FIPS mode for Kibana Feature:Reporting Reporting (PDF, CSV, ..) feature Team:SharedUX Team label for AppEx-SharedUX (formerly Global Experience)

Comments

@kc13greiner
Copy link
Contributor

Describe the feature:

Currently the Report class constructor is generating IDs using the puid library, specifically the puid.generate() function. This function uses md5, which is not FIPS compliant.

Describe a specific use case for the feature:

To be FIPS compliant, we need to remove all uses of insecure hashing algorithms, which includes md5.

A similar fix to #170177 would be ideal.

Acceptable hash algorithms can be found here on pg. 18 in Table 8
@kc13greiner kc13greiner added Feature:Reporting Reporting (PDF, CSV, ..) feature Team:SharedUX Team label for AppEx-SharedUX (formerly Global Experience) Feature:FIPS FIPS mode for Kibana labels Jan 12, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/appex-sharedux (Team:SharedUX)

@hainenber hainenber mentioned this issue Jan 13, 2024
Merged
1 task
tsullivan added a commit that referenced this issue Jan 24, 2024
@hainenber @tsullivan @kibanamachine
fix(x-pack/reporting): use FIPS-compliant ID generator uuidv4 in Re…
cd90773 
…porting plugin (#174809)

## Summary
Closes #174798 


### Checklist

Delete any items that are not applicable to this PR.



### Risk Matrix

Delete this section if it is not applicable to this PR.


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Tim Sullivan <tsullivan@users.noreply.github.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
@tsullivan
Copy link
Member

@kc13greiner this was picked up by a community member and the fix was just merged. Is there anything else needed as part of this?

lcawl pushed a commit to lcawl/kibana that referenced this issue Jan 26, 2024
@hainenber @tsullivan
@kibanamachine @lcawl
fix(x-pack/reporting): use FIPS-compliant ID generator uuidv4 in Re…
13caab8 
…porting plugin (elastic#174809)

## Summary
Closes elastic#174798 


### Checklist

Delete any items that are not applicable to this PR.



### Risk Matrix

Delete this section if it is not applicable to this PR.


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Tim Sullivan <tsullivan@users.noreply.github.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
CoenWarmer pushed a commit to CoenWarmer/kibana that referenced this issue Feb 15, 2024
@hainenber @tsullivan
@kibanamachine @CoenWarmer
fix(x-pack/reporting): use FIPS-compliant ID generator uuidv4 in Re…
991ef71 
…porting plugin (elastic#174809)

## Summary
Closes elastic#174798 


### Checklist

Delete any items that are not applicable to this PR.



### Risk Matrix

Delete this section if it is not applicable to this PR.


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Tim Sullivan <tsullivan@users.noreply.github.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
CoenWarmer pushed a commit to CoenWarmer/kibana that referenced this issue Feb 15, 2024
@hainenber @tsullivan
@kibanamachine @CoenWarmer
fix(x-pack/reporting): use FIPS-compliant ID generator uuidv4 in Re…
57cf883 
…porting plugin (elastic#174809)

## Summary
Closes elastic#174798 


### Checklist

Delete any items that are not applicable to this PR.



### Risk Matrix

Delete this section if it is not applicable to this PR.


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Tim Sullivan <tsullivan@users.noreply.github.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@eokoneyo eokoneyo

Labels
Feature:FIPS FIPS mode for Kibana Feature:Reporting Reporting (PDF, CSV, ..) feature Team:SharedUX Team label for AppEx-SharedUX (formerly Global Experience)
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(x-pack/reporting): use FIPS-compliant ID generator uuidv4 in Reporting plugin hainenber/kibana
4 participants
@tsullivan @eokoneyo @elasticmachine @kc13greiner