Zennoxa Shield
Rules / Rust
SHIELD-RUST-008

Weak cryptographic hash

highRustCWE-327CVSS 7.5

What it detects

MD5/SHA-1/DES are cryptographically broken and unsuitable for security use.

How to fix

Use SHA-256+ for hashing and Argon2/bcrypt/scrypt for passwords.

Vulnerable — Shield flags thishash.rs
use md5::{Digest, Md5};

pub fn fingerprint(data: &[u8]) -> String {
    let mut hasher = Md5::new();
    hasher.update(data);
    hex::encode(hasher.finalize())
}
Fixed — scans cleanhash.rs
use sha2::{Digest, Sha256};

pub fn fingerprint(data: &[u8]) -> String {
    let mut hasher = Sha256::new();
    hasher.update(data);
    hex::encode(hasher.finalize())
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUST-008, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUST-008: Weak cryptographic hash — Zennoxa Shield