DIRACGrid v9.1.10 security fix: MD5/SHA1 weak hash usage marked as non-security

DIRACGrid/DIRAC v9.1.10 Release Notes Summary Vulnerability Overview This release (v9.1.10) primarily contains multiple security and stability fixes, including the following security-related fix: FIX: Mark md5/sha1 usage as not used for security where appropriate (#8542): In appropriate locations, mark md5/sha1 usage as "not used for security" to mitigate security risks. Scope of Impact Affected module: (global) Related PR: #8542 Released version: v9.1.10 (released by github-actions on Jun 3, commit ) Fix Details Identify and mark md5/sha1 usage locations in the code, marking them as "not used for security" to avoid using weak hash algorithms in insecure contexts. Other Key Fixes (Non-Security, for Reference) Core: Updated profiler tests, used truncated sha256 as a proxy hash (cache), added an eval helper function, and allowed passing an args parameter in MySQL_query calls. RequestManagementSystem: Fixed REA iteration to use a copy of keys, and accelerated test path generation for Client_RequestTasks. WorkflowManagement: Fixed the path for retrieving job parameters in StalledJobAgent. CI: Added diracx RSS DB to the CI environment, fixed non-workflow pixi environment, and fixed the CI environment for pixi 0.68. FrameworkSystem: Used a serializable query for ProxyDB_purge_logs, and BundleDelivery added the owner-write bit to bundle files. DataManagementSystem: Fixed the default type for directory metadata in ConsistencyInspector, and ensured all updates in FileManger use the existing connection. Deps: Fixed a typo in the types-pyyaml dependency. POC / Exploit Code The page does not contain any POC or exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

DIRACGrid v9.1.10 security fix: MD5/SHA1 weak hash usage marked as non-security

More from this source