Skip to content

fix(ota): Add legacy option for devices using MD5 authentication #11861

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
+51 −18

fix(ota): Add legacy option for devices using MD5 authentication

99b029e
Select commit
Loading
Failed to load commit list.
Closed

fix(ota): Add legacy option for devices using MD5 authentication #11861

fix(ota): Add legacy option for devices using MD5 authentication
99b029e
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / CodeQL failed Sep 18, 2025 in 2s

1 configuration not found

Warning: Code scanning may not have found all the alerts introduced by this pull request, because 1 configuration present on refs/heads/master was not found:

Actions workflow (codeql.yml)

  • ❓  /language:cpp

New alerts in code changed by this pull request

Security Alerts:

  • 2 high

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 147 in tools/espota.py

See this annotation in the file changed.

Code scanning / CodeQL

Use of a broken or weak cryptographic hashing algorithm on sensitive data High

Sensitive data (password)
Loading
is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function.
Sensitive data (password)
Loading
is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function.

Check failure on line 159 in tools/espota.py

See this annotation in the file changed.

Code scanning / CodeQL

Use of a broken or weak cryptographic hashing algorithm on sensitive data High

Sensitive data (password)
Loading
is used in a hashing algorithm (SHA256) that is insecure for password hashing, since it is not a computationally expensive hash function.
Sensitive data (password)
Loading
is used in a hashing algorithm (SHA256) that is insecure for password hashing, since it is not a computationally expensive hash function.