HexBrain

Gratipay · Report #190015

Certificate signed using SHA-1

Duplicatestatus
mediumseverity
3upvotes
29 Dec 2016disclosed

How it was found

Hello, I detected a certificate signed using SHA-1. SHA-1 is a hash algorithm used in digital signatures. It is currently considered deprecated due to the increasing feasibility in breaking it.

Impact: Certificates can be forged by capable adversaries. Forged certificates can be used in MITM attacks against connecting clients.

Solution: Renew certificates with SHA-256 signatures. This should be done before 2016.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original