mcp-server-semgrep/semgrep-rules/java/lang/security/audit/crypto/use-of-md5.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: use-of-md5
  message: >-
    Detected MD5 hash algorithm which is considered insecure. MD5 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use HMAC instead.
  languages: [java]
  severity: WARNING
  metadata:
    functional-categories:
      - 'crypto::search::hash-algorithm::java.security'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    cwe:
    - 'CWE-328: Use of Weak Hash'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
  patterns:
    - pattern: |
       java.security.MessageDigest.getInstance($ALGO, ...);
    - metavariable-regex:
        metavariable: "$ALGO"
        regex: (.MD5.)
    - focus-metavariable: $ALGO
  fix: |
    "SHA-512"