Weak Cryptographic Algorithms #506
Description
Braintree SDK Version
6.16.0
Environment
Both
Android Version & Device
ALL
Braintree dependencies
implementation 'com.braintreepayments.api:drop-in:6.16.0'
Describe the bug
Risk Rating: Low
Category: Insufficient Cryptography
Description: Application supports SHA1 and MD5 hash function which is vulnerable algorithm.
SHA 1 and RIPEMD-128 is being used which is obsolete.
AES/CBC/PKCS5/PKCS7 Padding should be replaced with GCM.
RSA/ECB/PKCS1Padding – deprecated.
Impact: An attacker may be able to connect to the application using a weak or vulnerable encryption algorithm making it possible for an attacker to decrypt data.
Remediation Recommendation: Disable support for SHA1 and MD5 hash function. Use hashing algorithms such as SHA-256, SHA-384, or SHA-512.
To reproduce
N/A
Expected behavior
no Weak Cryptographic Algorithms
Screenshots
