Commits on Feb 6, 2022

1. Check value of usedforsecurity for hashlib …

   In Python 3.9+ hashlib has a new argument named usedforsecurity
   to indicate whether the hash is intended to be used for security
   or not. The default value is True. So a user must explicit set
   to False to state their non-security use.
   
   As a result of this chnage in Python, the severity has been
   moved up to HIGH if the usedforsecurity is True. But on earlier
   versions of Python, the severity will remain at MEDIUM since
   we don't know the intent of usage.
   
   https://docs.python.org/3/library/hashlib.html#hashlib.new
   
   Closes #748
   
   Signed-off-by: Eric Brown <browne@vmware.com>

   

   ericwb committed Feb 6, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for 2ef632a
   • Browse repository at this point

   Copy the full SHA

   2ef632a View commit details

   Browse the repository at this point in the history