search

doctrine / dbal

Doctrine Database Abstraction Layer
https://www.doctrine-project.org/projects/dbal.html
MIT License
9.48k stars 1.34k forks source link

vendor package issues #6619

Open eywa-saravanan opened 5 days ago

eywa-saravanan commented 5 days ago

Hi,

we face security issue.. need for solution..

issue detail given below

package name : Doctrine DBAL

Package link : https://github.com/doctrine/dbal

issue description :

line numbers : a) vendor/doctrine/dbal/src/Cache/QueryCacheProfile.php:130

1) An attacker can exploit the weaknesses of SHA-1 to perform collision attacks, potentially leading to data breaches and loss of data integrity.

solution need like this : It is recommended to avoid using SHA-1 for hashing. Instead, opt for stronger hashing algorithms such as SHA-256 to enhance security.

thanks

derrabus commented 5 days ago

Can you elaborate how a collision on a cache key is a possible security threat?