Zennoxa Shield
Rules / C/C++
SHIELD-CPP-013

Weak cryptographic primitive

highC/C++CWE-327CVSS 7.5

What it detects

Use of DES, MD5, or SHA1 provides broken or deprecated cryptographic strength.

How to fix

Use AES-GCM for encryption and SHA-256 or stronger for hashing.

Vulnerable — Shield flags thisdigest.c
#include <openssl/md5.h>

void fingerprint(const unsigned char *data, size_t len,
                 unsigned char out[MD5_DIGEST_LENGTH]) {
    MD5_CTX ctx;
    MD5_Init(&ctx);
    MD5_Update(&ctx, data, len);
    MD5_Final(out, &ctx);
}
Fixed — scans cleandigest.c
#include <openssl/sha.h>

void fingerprint(const unsigned char *data, size_t len,
                 unsigned char out[SHA256_DIGEST_LENGTH]) {
    SHA256_CTX ctx;
    SHA256_Init(&ctx);
    SHA256_Update(&ctx, data, len);
    SHA256_Final(out, &ctx);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-013, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CPP-013: Weak cryptographic primitive — Zennoxa Shield