Release Notes / Version 10.2101
Table Of ContentsSmooth migration from legacy to current hash generating strategy.
Since the existing
DefaultSecureHashCodeGeneratorStrategy
used for securing blob transformation was considered vulnerable to possible DoS attacks, a new default
MD5SecureHashCodeGeneratorStrategy
was introduced with version 10.2007.
The new
MD5SecureHashCodeGeneratorStrategy
wont match hashes created by the former
DefaultSecureHashCodeGeneratorStrategy
. Cached URLs would cause a HTTP 403 (forbidden) status code.
Therefore CoreMedia now provides a smooth migration path by using a strategy which will accept hashes created by both, the
DefaultSecureHashCodeGeneratorStrategy
and the
MD5SecureHashCodeGeneratorStrategy
.
New hashes will be created using the new
MD5SecureHashCodeGeneratorStrategy
.
The migration mode can be enabled by setting
cae.hashing.migration-mode=true
.
(CMS-18868)