How severe is weak hashing with md5 or sha1?

Shield rates this medium (CVSS 5.9), classified as CWE-327.

Rules / Ruby

SHIELD-RUBY-018

Weak hashing with MD5 or SHA1

mediumRubyCWE-327CVSS 5.9

Using MD5 or SHA1 for passwords or integrity is cryptographically broken.

Use bcrypt or Argon2 for passwords and SHA-256 or stronger for integrity.

Vulnerable — Shield flags thisapp/models/legacy_password.rb

require "digest"

class LegacyPassword
  def self.digest(input)
    Digest::MD5.hexdigest(input)
  end
end

Fixed — scans cleanapp/models/legacy_password.rb

require "bcrypt"

class LegacyPassword
  def self.digest(input)
    BCrypt::Password.create(input)
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-018, the fixed one does not.