Actions
Bug #23128
closedDeface uses MD5 and doesn't work in FIPS-enable environment
Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Security
Target version:
-
Difficulty:
Triaged:
No
Description
How to reproduce:
1. install a plugin that uses deface (e.g. katello, foreman_remote_execution…)
2. use the web server or call `rake apipie:cache:index`
Results:
MD5 is used by deface with the following backtrace:
| /opt/theforeman/tfm/root/usr/share/gems/gems/deface-1.2.0/lib/deface/action_view_extensions.rb:55:in `method_name' | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/template.rb:157:in `block in render' | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/activesupport-5.1.4/lib/active_support/notifications.rb:168:in `instrument' | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/template.rb:352:in `instrument_render_template' | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/template.rb:155:in `render' | /opt/theforeman/tfm/root/usr/share/gems/gems/deface-1.2.0/lib/deface/action_view_extensions.rb:41:in `render' | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/renderer/template_renderer.rb:64:in `render_with_layout' | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/renderer/template_renderer.rb:50:in `render_template' | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/renderer/template_renderer.rb:14:in `render' | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/renderer/renderer.rb:42:in `render_template' | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/renderer/renderer.rb:23:in `render' | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/helpers/rendering_helper.rb:32:in `render' | /opt/theforeman/tfm/root/usr/share/gems/gems/apipie-rails-0.5.6/lib/tasks/apipie.rake:121:in `block in render_page'
Actions