Feedback on Detected WEAK-ENCRYPTION

[zyue110026]

Greetings,

We are some security researchers who have built a scanner to detect known security weaknesses. For your repository, we have found instances of Weak Encryption in the following locations:

Location-1:

AWS.jl/test/AWS.jl

Line 95 in 100c30e

expected_content_md5 = base64encode(digest(MD_MD5, request.content))

Please give us feedback. Do you think these are valid instances on security weaknesses? Will you fix them?

[ericphanson]

That is in the tests, not the source code. The corresponding source code is

AWS.jl/src/utilities/sign.jl

Line 77 in 100c30e

"Content-MD5" => base64encode(digest(MD_MD5, request.content)),

I don't think that Content-MD5 header is for encryption but rather object integrity. The object is hashed with SHA256 as part of the the AWS v4 signature process.

So I don't think this is a security weakness.