Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8281561

Disable http DIGEST mechanism with MD5 and SHA-1 by default

    XMLWordPrintable

Details

    • Enhancement
    • Resolution: Fixed
    • P3
    • 19
    • None
    • core-libs
    • b16

    Description

      We should probably disable MD5 and SHA-1 in HTTP Digest authentication when used for tunneling or proxying and maybe other cases as well.

      Note that RFC 7616 added support for stronger algorithms than MD5 but no longer recommends MD5 be used [1]:

      "To maintain backwards compatibility with [RFC2617], the MD5 algorithm is still supported but NOT RECOMMENDED."

      More details should be added as well as an assessment of the compatibility risk.

      [1] https://datatracker.ietf.org/doc/html/rfc7616#section-3.2

      Attachments

        Issue Links

          csr for

          CSR - null JDK-8282649 Disable http DIGEST mechanism with MD5 by default

          • P3 - Major loss of function.
          • Closed
          links to

          Commit Commit openjdk/jdk/7f2a3ca2

          Review Review openjdk/jdk/7688

          There are no Sub-Tasks for this issue.

          Activity

            People

              michaelm Michael McMahon
              mullan Sean Mullan
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: