SEC009
Weak hash algorithm
Object Pascal — Delphi & Free Pascal
Warning
Security
MD5 and SHA1 are vulnerable to collision attacks and should not be used for security
MD5 and SHA1 are vulnerable to collision attacks and should not be used for security.
Why this severity
MD5 and SHA1 are vulnerable to collision attacks and should not be used for security.
Known false positives
non-security uses like checksums for cache invalidation.
Remediation example
Hash := THashSHA2.GetHashString(Data); // SHA-256 instead of MD5/SHA1