B303.md

Pattern: Use of insecure MD2, MD4 or MD5 hash function

Issue: -

Description

Avoid using hashes based on MD2, MD4 or MD5 to hash passwords or to encrypt data. These functions are no longer considered secure. Note that this might not be a problem for some use cases like checking file integrity. However, if you want to be be sure, switch to another hashing algorithm.

This rule checks for the following calls:

• hashlib.md5
• Crypto.Hash.MD2.new
• Crypto.Hash.MD4.new
• Crypto.Hash.MD5.new
• Cryptodome.Hash.MD2.new
• Cryptodome.Hash.MD4.new
• Cryptodome.Hash.MD5.new
• cryptography.hazmat.primitives.hashes.MD5

Further Reading

• Wikipedia - MD2
• Wikipedia - MD4
• Wikipedia - MD5
• Bandit - B303: md5