Zennoxa Shield
Rules / Python
SHIELD-PY-010

Weak MD5 or SHA1 hash usage

mediumPythonCWE-327CVSS 5.9

What it detects

MD5 and SHA1 are cryptographically broken and should not be used for security.

How to fix

Use hashlib.sha256() or hashlib.sha3_256() instead.

Vulnerable — Shield flags thisauth.py
import hashlib

def hash_password(password: str) -> str:
    return hashlib.md5(password.encode()).hexdigest()

def verify(password: str, stored: str) -> bool:
    return hash_password(password) == stored
Fixed — scans cleanauth.py
import hashlib

def hash_password(password: str) -> str:
    return hashlib.sha256(password.encode()).hexdigest()

def verify(password: str, stored: str) -> bool:
    return hash_password(password) == stored

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-010, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-010: Weak MD5 or SHA1 hash usage — Zennoxa Shield