rules:
- id: use-of-md5
  message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and
    is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
  languages:
  - kt
  severity: WARNING
  metadata:
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    cwe:
    - 'CWE-328: Use of Weak Hash'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5
    category: security
    technology:
    - kotlin
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
  pattern-either:
  - pattern: |
      java.security.MessageDigest.getInstance("MD5")
  - pattern: |
      org.apache.commons.codec.digest.DigestUtils.getMd5Digest()