sy2339226
sy2339226
**Describe the bug** We found that there are some problems in the code of this project, including: (1) unsafe algorithms; (2) unsafe parameter configuration. We 've described detailed information in...
I am a security researcher and recently used our designed Golang code scanning tool during security audits. During this process, I regretfully discovered some vulnerabilities in your project that may...
I am a security researcher and recently used our designed Golang code scanning tool during security audits. During this process, I regretfully discovered some vulnerabilities in your project that may...
Using MD5 to generate API-keys and Skipping TLS Certificate Verification MD5 is a relatively outdated hash algorithm. There's a risk of malicious ID collisions by attackers when generating API-keys using...
**Is your feature request related to a problem? Please describe.** I've noticed that the project uses an insecure practice in password storage and RSA key size selection. Specifically, the project...
Per the recommendations outlined in NIST 800-57, it is now advised to utilize algorithms with strengths of >=128 bits. We have identified within your code the use of slightly weaker...
Your code utilizes MD5(sha1) for id generation. MD5 is categorized as a less secure hashing algorithm due to its susceptibility to various cryptographic attacks, particularly collision attacks. A collision occurs...
Is your feature request related to a problem? Please describe. In the go-micro package, specifically in the file github.com/go-micro/go-micro/broker/http.go at line 84 within the newTransport function, there is a default...
## 问题及现象 都2024年了，这些算法确实不太安全了，别用这种上古算法签名了，有点子危险，这么签出来的东西很可能被人伪造消息或者证书啥的，挺危险的，建议考虑全局替换个sha256, 512之类的 landv/wechat/pay/notify_result.go landv\wechat\pay\pay.go landv\wechat\pay\refund.go sign := util.MD5Sum(signStrings) ------------------------------------------------------ /github.com/landv/wechat/util/signature.go 这里面使用了sha1算法，和md5差不多，也很危险
github.com/Terry-Mao/goim/pkg/websocket/server.go 这里面用sha1算法计算密钥accesskey，sha1有一些弱了，换成sha256很方便