Odoo Changelog — 2019-09-20

Friday, September 20, 2019

1 change · master

Security(1)

Security fixes and vulnerability patches

[IMP] base,web: use SHA2 over SHA1

Coremasterbasewebhttp_routingwebsiteSECURITY

This update replaces older SHA-1 checks with stronger SHA-2 hashing for cached web resources and adds collision checks for stored attachments. It reduces security risk around file storage and browser-cached assets while keeping day-to-day behavior unchanged for users.

Original PR description

SHA-1 is a cryptographic hash function that have weaknesses known since 2005, it has been deprecated by the NIST [1] about 10 years ago in 2011 and Google [2] have been able to perform a collision…

SHA-1 is a cryptographic hash function that have weaknesses known since
2005, it has been deprecated by the NIST [1] about 10 years ago in 2011
and Google [2] have been able to perform a collision attack in 2017.

We use SHA-1 to compute the checksum of every attachment and reuse that
checksum in order to store the file on disk. The purpose is only store
the file once and possibly link that file in many attachments.

We use SHA-1 in order to generate unique URL for resources that can be
cached by the browser: assets bundle, translations, qweb templates and
qweb images.

Although practical attacks still requires quite a lot of computational
resources, it is time to upgrade SHA-1 to SHA-2.

To prevent attacks on the filestore, when uploading a file that has
the same SHA-1 as a stored file, we perform a SHA-2 computation
on both files to verify their signature. If their SHA-2 signature is 
different, an error is raised.

We have selected the SHA-512/256 variant of the SHA-2 algorithm as
replacement for SHA-1 for the following reasons:

* On 64 bits platform, SHA-512 is the fastest SHA-2 variant, it is only
  ~1.5x slower than SHA-1. [3]
* Keeping only the 256 foremost bits protects against both collision
  attacks and length extension attacks.
* The hexadecimal digest is only 24 chars longer than SHA-1 which is
  nice to have somewhat short URLs.

We have not used SHA-3 because:

* At the moment of writing, it is too slow (~3x slower than SHA-1) [3]
* It is not guaranteed to be available with the Python 3.5 `hashlib`
  module.
* One of the author of SHA-3 is Belgian.

[1] https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash-functions
[2] https://shattered.io/
[3] http://bench.cr.yp.to/results-hash.html
[4] http://www.commitstrip.com/en/2017/02/27/the-sha-1-alternative/

task-31589

#security#attachments#cache#hashing

SHA-1 is a cryptographic hash function that have weaknesses known since 2005, it has been deprecated by the NIST [1] about 10 years ago in 2011 and Google [2] have been able to perform a collision attack in 2017. We use SHA-1 to compute the checksum of every attachment and reuse that checksum in order to store the file on disk. The purpose is only store the file once and possibly link that file in many attachments. We use SHA-1 in order to generate unique URL for resources that can be cached by the browser: assets bundle, translations, qweb templates and qweb images. Although practical attacks still requires quite a lot of computational resources, it is time to upgrade SHA-1 to SHA-2. To prevent attacks on the filestore, when uploading a file that has the same SHA-1 as a stored file, we perform a SHA-2 computation on both files to verify their signature. If their SHA-2 signature is different, an error is raised. We have selected the SHA-512/256 variant of the SHA-2 algorithm as replacement for SHA-1 for the following reasons: * On 64 bits platform, SHA-512 is the fastest SHA-2 variant, it is only ~1.5x slower than SHA-1. [3] * Keeping only the 256 foremost bits protects against both collision attacks and length extension attacks. * The hexadecimal digest is only 24 chars longer than SHA-1 which is nice to have somewhat short URLs. We have not used SHA-3 because: * At the moment of writing, it is too slow (~3x slower than SHA-1) [3] * It is not guaranteed to be available with the Python 3.5 `hashlib` module. * One of the author of SHA-3 is Belgian. [1] https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash-functions [2] https://shattered.io/ [3] http://bench.cr.yp.to/results-hash.html [4] http://www.commitstrip.com/en/2017/02/27/the-sha-1-alternative/ task-31589